5 ms·
The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data: Google Anal
by Jakob 9y ago
The legal ramifications of storing IP addresses didn’t change with GDPR. You should already have them anonymized since they count as personal data:
Google Analytics (https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization https://developers.google.com/analytics/devguides/collection...):
ga('set', 'anonymizeIp', true);
Web server (here nginx, https://stackoverflow.com/a/45405406 https://stackoverflow.com/a/45405406):
map $remote_addr $remote_addr_anon {
~(?P<ip>\d+\.\d+\.\d+)\. $ip.0;
~(?P<ip>[^:]+:[^:]+): $ip::;
default 0.0.0.0;
}
Only if you store more data about your customers/users you need to act further.
- ahoka 9y agoYou can also irreversibly hash sensitive data it so you can still use it for debugging.
- emilfihlman 9y agoIPV4 is only 4 bytes. Hashing through all 4 milliard is trivial.
- NullPrefix 9y agoAnother reason for IPv6.
- pdkl95 9y ago> ga('set', 'anonymizeIp', true); Note that this doesn't actually provide any useful anonymization. That feature is a placebo designed to give minimal compliance with privacy policies and pre-GDPR data protection requirements. https://news.ycombinator.com/item?id=13639921 https://news.ycombinator.com/item?id=13639921
- SquareWheel 9y agoAre IP addresses actually considered "personal data"? They are how computers talk to each other. Anonymizing them doesn't make any sense to me.
- s73v3r_ 9y agoThey're anonymized for things like logs. When the computers aren't talking to each other, the reasons to know the exact IP address are rather minimized. If you feel you have a real need to do so, then you just need to inform your users what you're doing.