How Much of AIS Is Personal Data?

This piece follows on from Navigating Ethical Challenges: AI, Big Data, Trust and Governance in the Maritime Industry, which sets out the legal background.

Every large ship at sea broadcasts its identity, position, course and speed, in the clear, several times a minute. The Automatic Identification System was built for collision avoidance, and it works: anyone with a receiver can see the traffic. Governments publish the archives as open data, and analysts like me use them freely.

Which raises a question that sounds simple and is not. Is an AIS track personal data?

I spent a week of open Danish AIS data — 170 million messages — trying to answer it with a number rather than an opinion. The answer turned out to depend on something nobody mentions: the month you happen to look.

Why the question is not obvious

The GDPR protects information about people. It does not protect information about companies. A container ship’s AIS track identifies a vessel and, through the registry, the company that operates it. No individual is involved, so the data protection questions largely fall away.

A small sailing boat is a different matter. The boat is, in practice, its owner. A week of positions for that boat is a week of one identifiable person’s movements — where they went, when they left, how long they stayed, which harbour they call home.

This is not my inference. Reviewing the EU’s fisheries control rules, the European Data Protection Supervisor said that vessel monitoring data is personal data “as long as these data can be linked to identified or identifiable individuals”, naming the master, the owner and the crew. The principle has been settled for years.

What nobody has done is count. Everyone knows some AIS traffic is small boats. How much? That is an empirical question, and the data to answer it is sitting in public.

What I measured

I took seven consecutive days of open AIS data published by the Danish Maritime Authority — Sunday 13 to Saturday 19 July 2025 — and reduced 170,200,617 messages to one row per vessel. That left 16,948 distinct vessels.

For each vessel I asked whether it is more likely operated by a person or by a company, using three properties that are recorded independently of one another:

• The reported ship type: sailing, pleasure, fishing, cargo, tanker and so on.
• Whether it carries an IMO number. These are assigned to larger commercial ships; small private craft do not have them.
• Which class of transponder it uses. Class A is the expensive equipment carried by commercial vessels under international rules; Class B is the cheaper set fitted to small craft.

A vessel counts as plausibly personal when it has no IMO number and is either a sailing or pleasure craft, or a fishing vessel of fifteen metres or less. Small fishing boats are the clearest case in the EDPS opinion, which is why they are in.

The three signals agree to a degree that surprised me. Of the sailing and pleasure vessels, 98.3% use a Class B transponder and 99.6% have no IMO number. Of the cargo ships, 95.4% have one, and of the tankers, 97.4%. The median recreational vessel is 11 metres long; the median cargo ship is 114. Three measurements, taken separately, describing the same division.

Two points of method matter. The first is that this classification is an inference, not a verified fact: I am reading ownership off a vessel’s reported type, its lack of a registration number and the equipment it carries, and I checked none of it against a record of who owns the boat. The second is that I never tried to identify anyone, and the analysis holds no positions, no timestamps and no vessel identities. What follows is a count of how many vessels fall into a category the law treats as personal data. It is a ceiling on exposure, not a measurement of it.

Two thirds of the boats

In that July week, 11,309 of the 16,948 vessels — 66.7% — were plausibly personal. Not a fringe. The clear majority of everything transmitting in Danish waters.

The median vessel length across the entire dataset was twelve metres. When people picture AIS they picture shipping lanes and tankers. The data mostly contains small boats.

A quarter of the data

Those same 11,309 vessels produced only 25.8% of the messages.

The reason is simple once you see it. A cargo ship transmits continuously, all week, wherever it is. A sailing boat transmits on a Sunday afternoon and then sits silent in a marina. Commercial vessels dominate the message volume no matter how few of them there are.

This gap is the first real finding, and it is a trap for anyone assessing this kind of data. Measured by volume, personal data looks like a marginal fraction of AIS — a quarter, and easy to treat as an edge case. Measured by people, it is two out of every three vessels. Same dataset, two opposite conclusions, depending on which denominator you happen to choose.

Figure 1. The share of AIS that is plausibly personal data, by vessels and by message volume.

And then it changes with the season

To see whether July was representative, I repeated the exercise on Sunday 11 to Saturday 17 January 2026 — the following winter, same days of the week, same pipeline, 115 million more messages.

The share of vessels that are plausibly personal fell from 66.7% to 18.5%. The share of messages fell from 25.8% to 11.3%. This is not a seasonal wobble around a stable figure. The character of the dataset changes.

The cause is visible in the vessel counts, and it is the most satisfying part of the analysis. The commercial fleet barely moves between the two weeks: cargo vessels go from 1,295 to 1,231, tankers from 496 to 480. The recreational fleet disappears: sailing craft fall from 5,932 to 233, pleasure craft from 5,011 to 455.

Figure 2. Distinct vessels by reported ship type. The commercial fleet is the constant; the leisure fleet is the variable.

Commercial vessel numbers fell 28% between July and January. Recreational numbers fell 92%. The proportion of AIS that is personal data does not move because the shipping industry changed. It moves because the boats went home for the winter.

That near-identical commercial count across six months is also the best quality check in the study. Two independent runs, on different files, counted the same working fleet to within a few per cent. Whatever else is going on, the pipeline is measuring something real.

What this means in practice

If you are assessing whether a maritime dataset carries personal data, the honest answer is: it depends when you looked.

An organisation that evaluates AIS in January can reasonably conclude that it is overwhelmingly commercial telemetry, with a modest privacy tail. The same organisation evaluating the same feed in July is looking at a dataset that is two thirds small boats with identifiable owners. Neither assessment is wrong about its own data. Both would be wrong to treat the conclusion as a fixed property of the system.

This has practical consequences. A compatibility assessment for reusing vessel data, a data protection impact assessment, a decision about retention or sharing — all of these are usually done once and filed. For seasonal data they need either a worst-case assumption or a periodic review. A privacy assessment with a date on it is only true for that date.

It also suggests where to look. The exposure is concentrated in a specific, identifiable group: small craft, Class B transponders, no IMO number. That group is easy to isolate in any AIS pipeline, which means proportionate safeguards — coarser positions, shorter retention, aggregation before publication — could be applied to the vessels that need them without degrading the commercial traffic analysis that most users actually want.

How much should you trust this?

The obvious objection is that I chose the fifteen-metre limit for fishing vessels, and a different limit would give a different answer. So I varied it.

Figure 3. The result against every fishing-vessel length limit from ten to thirty metres.

Between ten and thirty metres, the July figure moves from 65.6% to 67.9% and the January figure from 15.9% to 22.3%. The gap between the seasons survives every threshold. The headline is not an artefact of where I drew the line.

A second objection is the unit of counting. Counting distinct vessels across a week treats a yacht that passes through once the same as a cargo ship present for all seven days. So I recomputed the July figure three further ways. Weighting each vessel by the number of days it appeared gives 66.2%. Excluding vessels seen on a single day with fewer than fifty messages gives 69.5%. Taking the average number of small-craft transponders present per day gives 68.1%. The unit of counting does not drive the result.

Two other checks. Using only the transponder class — ignoring the self-reported ship type entirely — gives 71.1% in July and 21.0% in January: the same story from an independent signal. And the vessels with no recorded ship type, which are the genuinely ambiguous cases, are 8.2% of vessels but only 1.5% of messages, too few to move the result whichever way they are counted.

The data itself is in better condition than I expected. Across 160 million vessel messages, 0.13% had no usable position, 0.67% carried an identifier that is not a valid ship station number, and 3.6% were missing a vessel length. No impossible coordinates at all.

What could be wrong

Every figure above rests on assumptions, and some of them I could not test. In order of how far they could move the result:

The classification was never validated against an ownership registry. This is the weakest point in the study, and it sits directly beneath the headline figure. I infer that a vessel belongs to a person from its reported type, its lack of an IMO number and its transponder class. I did not check one of those inferences against a record of who actually owns the boat. Charter fleets, sailing clubs and company-owned yachts all exist, and every one of them is counted here as personal. The figure is a ceiling whose slack I cannot measure. Anyone wanting the true number rather than the ceiling has to do that work.

Ship type is self-reported and nobody verifies it. The type comes from the vessel’s own transponder configuration. A unit set up wrongly reports the wrong type indefinitely, and I would inherit the error without ever seeing it. I can show that only 0.16% of vessels reported inconsistent types during the week, which is reassuring about carelessness but says nothing about a boat that is consistently mislabelled.

One identifier was treated as one vessel. Distinct vessels are counted by MMSI. Duplicate identifiers on inexpensive equipment and deliberate spoofing both occur in practice, and 0.67% of messages carried an identifier that is not a valid ship station number at all. I did not investigate how many vessels this affects.

Reception is not neutral between the two groups. Class B transponders transmit at lower power and less often than Class A, so small craft are more likely to go unheard by a shore station — but they also stay close to the coast, where reception is best. I have not established which effect dominates, so I cannot give the direction of that bias, let alone its size.

The legal reading is mine. The EDPS opinion I rely on predates the GDPR and concerns fisheries vessel monitoring rather than recreational AIS. Extending it is my interpretation, not a regulator’s finding, and a data protection lawyer could reasonably put the line somewhere else.

The seasonal comparison confounds season with time. July 2025 and January 2026 are six months apart, so part of the difference between them could be a trend rather than a season. Two samples cannot separate the two; a full year would.

These are vessels seen in Danish waters, not a registry of any fleet. Denmark has an unusually strong recreational boating culture. Other sea areas will differ, possibly by a lot.

None of this touches the seasonal result, which is the finding I would defend hardest. The commercial fleet is stable across the two weeks to within a few per cent while the recreational fleet falls by more than ninety, and no plausible classification error produces a gap of that size. What the caveats bear on is the precise height of the summer bar, not the shape of the picture.

Finally: the code is tested, the reasoning is not reviewed. The tests confirm that the software does what I intended. They cannot confirm that what I intended was right.

Contains data from the Danish Maritime Authority that is used in accordance with the conditions for the use of Danish public data. The Danish Maritime Authority does not approve, support or endorse this analysis.

Sources

Danish Maritime Authority. Historical AIS data (open data). http://aisdata.ais.dk/

Danish Maritime Authority. Conditions for the use of data. https://dma.dk/safety-at-sea/navigational-information/download-data/conditions-for-the-use-of-data

European Data Protection Supervisor (2011). Opinion on the Commission Implementing Regulation (EU) No 404/2011 laying down detailed rules for the implementation of the Fisheries Control Regulation, 28 October 2011. https://edps.europa.eu/sites/default/files/publication/11-10-28_fisheries_en.pdf

European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(1) and Recital 26. OJ L 119, 4.5.2016. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

ITU (2019). Recommendation ITU-R M.585-8, Assignment and use of identities in the maritime mobile service. https://www.itu.int/rec/R-REC-M.585/en

ITU. Recommendation ITU-R M.1371, Technical characteristics for an automatic identification system using VHF. https://www.itu.int/rec/R-REC-M.1371/en