The Supreme Court of Canada says police need judicial authorization to obtain a computer user鈥檚 internet protocol address, calling the identification number a crucial link between a person and their online activity.

The top court鈥檚 5-4 ruling came Friday in a case that began in 2017, when Calgary police investigated fraudulent online transactions from a liquor store.

The store鈥檚 third-party payment processor voluntarily gave police two IP addresses 鈥� numerical identifiers assigned by an internet service provider.

Police obtained a production order compelling the service provider to disclose the names and street addresses of the customers.

Police then got warrants to search two homes, leading to the arrest of Andrei Bykovets, who was eventually convicted on several counts.

The trial judge had rejected the argument that the police request to obtain the IP addresses violated his Charter of Rights guarantee against unreasonable search and seizure.

A majority of the Alberta Court of Appeal dismissed Bykovets鈥檚 appeal, prompting him to take his case to the Supreme Court.

The high court allowed Bykovets鈥檚 appeal, set aside his convictions and ordered a new trial.

Writing for a majority of the court, Justice Andromache Karakatsanis said an IP address 鈥渋s the key to unlocking a user鈥檚 internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy.鈥�

IP addresses are not just meaningless numbers, she wrote. As the link that connects internet activity to a specific location, they may betray deeply personal information 鈥� including the identity of the device鈥檚 user 鈥� without ever triggering a warrant requirement.

Karakatsanis said that if the Charter provision against unreasonable search 鈥渋s to meaningfully protect the online privacy of Canadians in today鈥檚 overwhelmingly digital world, it must protect their IP addresses.鈥�

The British Columbia Civil Liberties Association, an intervener in the case, called the decision a huge victory for online privacy.

鈥淐anadians can have the peace of mind that their online activities are safer from the prying eyes of the state,鈥� said Vibert Jack, the association鈥檚 litigation director.

in the ruling, Karakatsanis said police should have the investigative tools to deal with crime committed and facilitated online. However, she concluded that requiring police to obtain judicial authorization before obtaining an IP address 鈥渋s not an onerous investigative step.鈥�

She disagreed with the Crown鈥檚 suggestion that an IP address is useless without a subsequent warrant to obtain a name and street address.

First, as the link that connects specific internet activity to a specific location, an IP address may betray deeply personal information, even before police try to link the address to the user鈥檚 identity, she said.

Second, activity associated with the IP address can be correlated with other online activity associated with that address available to the state 鈥� with particularly concerning consequences when coupled with access to information held by third parties, Karakatsanis wrote.

Finally, an IP address can set the state on a trail of internet activity that leads directly to a user鈥檚 identity, even without a subsequent warrant, she added.

When linked to financial intermediaries like Moneris or PayPal, an IP address can reveal all of a user鈥檚 transactions on that intermediary over the period the IP address was assigned to them, the ruling says.

In turn, these purchases might reveal an array of personal information, from the restaurants someone visits to the hobbies they enjoy and the health supplements they use.

鈥淲ebsites offering dating services or adult pornography can give the state a depiction of the user鈥檚 sexual preferences,鈥� Karakatsanis wrote. 鈥淎n internet user鈥檚 history on medical, political, or other similar online chatrooms can reveal their health concerns or political views.

鈥淚f an IP address is not protected, this information is freely available to the state without the protection of the Charter whether or not it relates to the investigation of a particular crime.鈥�

The four dissenting judges said the appeal should be dismissed, finding Bykovets did not have a reasonable expectation of privacy in the IP addresses on the credit card processor鈥檚 servers and the internet service provider they revealed.

However, they said another person might have a reasonable expectation of privacy in a different scenario.

The reasonable expectation of privacy test is fact-specific and contextual, and depends on the totality of the circumstances of a particular case, the four judges said.

Jim Bronskill, The Canadian Press