Concomitant with the proliferation of cybercrime in India has been the use of Internet Protocol (IP) addresses by law enforcement agencies to track down criminals. While useful in many situations, the potential for misuse of this information raises important concerns for the privacy of individuals online. This note reviews the statutory mechanisms regulating the retention and disclosure of IP addresses by internet companies in India. It identifies and analyses the four broad sources to which the regime of IP Address disclosure by Internet Service Providers (ISP) may be traced: under the (i) operating licenses issued under the Telegrah Act, 1885, (ii) Information Technology Act, 2000, (iii) Code of Criminal Procedure, 1973 (hereinafter, “the Cr.P.C.”) and (iv) contractual agreements between users and ISPs. It concludes that the various layers of Indian law create an atmosphere that is intensely hostile to the withholding of such information by ISPs and intermediaries. Despite this, the author submits that there remains scope for optimism.