IPv4 vs IPv6: What the Shift Means for Your Privacy

IPv6 changes what an IP address reveals about you in two opposite ways. Without NAT, each device usually has its own globally reachable address, so a single address points at one machine rather than a whole household. At the same time, IPv6 privacy extensions rotate the device part of the address on a schedule, so the address a website sees today is unlikely to match the one it sees next week. The network prefix stays stable for as long as your ISP keeps it, which is what geolocation and ISP lookups key on. IPv6 does not encrypt anything by itself: IPsec is part of the IPv6 family of standards, but current node requirements only recommend supporting it, and almost no consumer traffic uses it. What actually protects your privacy is how your ISP assigns prefixes, whether your devices rotate temporary addresses, and whether your VPN tunnels IPv6 at all.

IPv4 usually hides many devices behind one shared address (NAT and carrier-grade NAT); IPv6 usually gives each device its own.

IPv6 privacy extensions (RFC 8981, which replaced RFC 4941) generate temporary addresses that change on a schedule, typically daily, which limits long-term tracking by address alone.

The first part of an IPv6 address, the prefix, identifies your ISP and often your connection; it changes only when the ISP reassigns it, so it is what lookups and geolocation use.

IPsec is not mandatory in IPv6 and is not switched on for ordinary browsing. The IPv6 node requirements (RFC 8504) say nodes should support it; they do not require it, and support is not the same as use.

A VPN that only carries IPv4 leaves your IPv6 address visible. Test both address families before trusting a VPN.

IPv4 uses 32-bit addresses, about 4.3 billion in total. To stretch that pool, networks rely on Network Address Translation (NAT), which places many devices behind one public address, and many mobile and some fixed-line ISPs add carrier-grade NAT on top, so a single public IPv4 address can stand for hundreds of subscribers. That sharing is accidental privacy: a website sees the shared address, not your device, but it also means one abusive user can taint the address for everyone behind it.

IPv6 uses 128-bit addresses, roughly 3.4 x 10^38 of them, so every device can have a globally unique address without NAT. A typical home receives a prefix (often a /56 or /64) from the ISP; each device then forms its own addresses inside that prefix. With stateless address autoconfiguration, the device chooses the second half of the address itself. Older implementations derived it from the hardware (MAC) address, which made a device trackable across networks; RFC 8981 privacy extensions replace that with random temporary addresses that are regenerated regularly and retired after a preferred lifetime, one day by default.

When you visit a website, the server sees the address your connection uses. Under IPv4 and NAT that address represents many people, so tracking an individual by address alone is hard but not impossible when combined with cookies or fingerprinting. Under IPv6 with privacy extensions the full address changes often, which weakens address-based profiling, but the prefix persists. A tracker that keys on the /64 or /56 prefix rather than the full address can still follow a connection for as long as the ISP keeps the assignment, which for many fixed-line ISPs is weeks or months. Geolocation databases work the same way: they map prefixes to an ISP and an approximate area, so IPv6 lookups are usually no more precise than IPv4 ones and often less, because coverage is thinner.

IPsec is a set of protocols for authenticating and encrypting IP packets, and it was designed alongside IPv6. That history is why many articles say IPv6 "has built-in encryption". It does not, in any practical sense. RFC 8504, the current IPv6 node requirements, states that nodes SHOULD support the IPsec architecture; earlier documents used MUST, and the requirement was deliberately relaxed. Even where a device supports IPsec, nothing turns it on for web traffic. Encryption between your browser and a website comes from TLS (HTTPS), on IPv4 and IPv6 alike, and the network can still see which addresses are talking to each other either way.

Checking VPN or proxy effectiveness: look up your address before and after connecting to see whether your real IPv4 or IPv6 address is still visible. A VPN that only tunnels IPv4 leaks the IPv6 address.

Confirming that privacy extensions are active: look up your IPv6 address on two different days. If the part after the prefix has changed, temporary addresses are working; if it is identical, your device may be using a stable or hardware-derived address.

Troubleshooting a dual-stack network: knowing whether a connection is using IPv4 or IPv6 tells you which path to debug when a site works on one and fails on the other.

Assessing geolocation exposure: compare what a lookup reports for your IPv4 and IPv6 addresses. The two often resolve to different cities because the databases behind them differ, which is a useful reminder of how approximate both are.

Assuming IPv6 is automatically safer: a device with privacy extensions disabled, or a server with a static address, is more identifiable than one behind IPv4 NAT.

Ignoring dual-stack leaks: many networks run IPv4 and IPv6 together. Test both, and check whether your VPN client either tunnels IPv6 or blocks it.

Relying on IP geolocation for security decisions: it is approximate for both protocols and, for IPv6, often only regional. Treat it as context.

Overlooking DNS: even with the address hidden, DNS queries can reveal which resolver you use and roughly where you are. Use a resolver inside the VPN tunnel or one you trust.

Confusing the prefix with the address: rotating the device half of an IPv6 address does nothing about the prefix, which is what identifies your connection to trackers and to geolocation databases.

Treating every new IPv6 address as a new user: this one is for site owners. With privacy extensions on, a returning device presents a fresh address every day or so, so per-address counters, bans and "new device" alerts misfire. Group activity by the /64 prefix or, better, by account and device; make sure logging, validation and rate limits handle IPv6 at all instead of carrying over IPv4-only assumptions; and read a new address as new context, not as a new person.

Crafzo shows both of your public addresses when your connection has both, together with the ISP, organization and approximate location that lookups associate with each.

Open the lookup page without entering an address. Crafzo detects your public IPv4 and, where present, IPv6 address and shows them side by side in the result header.

Record the baseline: note both addresses, the ISP and the reported location. This is what any website sees when you are not using a VPN.

Connect your VPN and run the lookup again. Both addresses should now belong to the VPN provider. If the IPv6 address is unchanged from your baseline, the VPN is leaking IPv6; disable IPv6 in the VPN client or on the device, or choose a client that tunnels it.

Repeat a day later to confirm that the IPv6 address after the prefix has rotated. If it has not, check the privacy-extensions setting on your operating system.