Device ID can go missing, and so can a cookie. An IP address almost never does, which doesn’t make it any more stable.
An IP address is a routing address: a network location for delivering a packet, not an identity. It only has to be right long enough for one delivery, nothing about it was built to stay attached to a person over time.
NAT is the trick a router uses to let many devices share one address, and CGNAT is the same trick run by the carrier instead of your router. It’s driven by plain IPv4 exhaustion, only about 4.3 billion IPv4 addresses exist and none are left to hand out, and it’s standardized, not a workaround: internet technical standards require these devices to limit how many connections each subscriber gets. Ordinary office or cafe WiFi does the same sharing through plain NAT: one documented setup showed a single device supporting up to 8,000 people before its roughly 60,000 connection slots ran out. A VPN’s exit server runs the same trick, just chosen by the user instead of assigned by a carrier. The address itself isn’t fixed either. It changes on lease renewal, a router restart, or just moving networks, home WiFi to mobile data.
IPv6 has its own churn built in, and there’s a real reason for it. Left alone, IPv6 can build a device’s actual hardware address into the address itself, the same value on every network it joins, letting anyone who sees the traffic recognize it across networks and even read the manufacturer off part of it. Privacy extensions exist specifically to cover that up, swapping in a fresh, randomized address roughly every 24 hours instead, standard across every major modern operating system.
Some exchanges blur it further on purpose. IPv4 gets its last number zeroed before a buyer ever sees it, confirmed against real traffic. IPv6 gets wiped down to a fixed size too, and that doesn’t reliably hide anyone. How much ground that covers depends on how the ISP handed the block out, and plenty give one household exactly that size on its own. So the wipe can look like it blurs several homes together when it is really just one house’s address, untouched.
The same address also gets used to guess where someone is, and that guess was never precise either. The databases behind it describe a circle with a radius from 5km to hundreds of km, not a point, warning against reading it at street level. Starlink is a clear example: its own support documentation notes the IP-based location can be off by entire states, because the address reflects wherever the connection surfaces at one of its data center hookups, not the dish itself.
Cap on an IP address and you will almost always have something to count against. Sharing, churn, deliberate blurring, and geolocation that was never precise all mean it rarely points at the same person twice. It is part of why linking an IP to a specific person downstream is so hard too, because that work is built on a foundation that keeps shifting under it.
