Carrier-grade NAT (CGNAT) explained

With carrier-grade NAT, the public address websites see is not yours alone: your provider shares it between many customers at once.

Why providers do it

There are only about 4.3 billion IPv4 addresses and they have all been handed out. A provider with ten million customers cannot buy ten million addresses. So it does on a large scale what your home router does on a small one: it gives each customer a private or shared address, and passes everyone's traffic to the internet through a much smaller set of public addresses. This is carrier-grade NAT, shortened to CGNAT or CGN. It is the normal arrangement on mobile data almost everywhere, and common on home fibre and wireless broadband too.

How to check whether you are behind CGNAT

Note the public IPv4 address on our home page.
Log in to your router (see router login) and find the WAN or Internet status page. Note the "WAN IP address" shown there.
Compare the two.

They are the same: you have a public address of your own. No CGNAT.
They differ, and the router's WAN address starts with 100.64 to 100.127, 10., 172.16 to 172.31 or 192.168.: you are behind CGNAT. The 100.64.0.0/10 range was set aside specially for this purpose.

On a phone using mobile data you can assume CGNAT.

What works as usual

Browsing, video, calls, messaging, online shopping, banking, cloud storage and most online games. Anything where your device starts the connection is unaffected, and that covers almost everything most people do.

What stops working

Port forwarding. You can open a port in your own router, but the provider's equipment in front of it will not pass incoming connections to you.
Reaching a home camera, recorder or computer directly from outside, and dynamic DNS names that point at your address.
Hosting a game server, website or file server at home.
Some peer-to-peer features: a game console may report a "strict" or "Type 3" NAT, and joining certain multiplayer sessions or voice chats gets harder.

A website may show you captchas more often, or block you, because another customer on the same address misbehaved.
Look-ups of your location by address are less accurate, since the address belongs to a regional gateway and not to your home.

What you can do

Ask the provider for a public or static IPv4 address. Many offer it on request, often for a monthly fee.
Use IPv6. If your provider and router support IPv6, each device gets a real public IPv6 address with no sharing. Incoming connections are then possible over IPv6 once you allow them in the router's firewall, provided the other end also has IPv6.
Use a tunnel or relay service. Your device at home makes an outgoing connection to a service on the internet, and you reach the device through that service. Mesh VPN tools and the "remote view" clouds of camera makers work this way, which is why they function behind CGNAT.
Use the maker's app for cameras and recorders rather than direct access.

Is CGNAT less safe?

No. It adds one more layer that unasked incoming traffic cannot pass. It is also not a privacy tool: the provider logs which customer used which address and port at what time.

How many people share my address?

It varies by provider and time of day, from a handful to hundreds. Each customer gets a slice of the address's port numbers.

Does CGNAT slow the internet?

Not in a way you would notice. The extra translation step adds a tiny delay. Slow evenings come from crowded lines, not from CGNAT.

Why do I see a 100.x address in my router?

Addresses from 100.64.0.0 to 100.127.255.255 are reserved for the link between a provider's CGNAT equipment and its customers. Seeing one on your router's WAN page is the clearest sign of CGNAT.