4 ms·

You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it c

by grabeh 8y ago

You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available. Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en

akvadrako 8y ago
Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect. Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.
- grabeh 8y ago
  If your reference to 'you' means someone running a site who only has possession of a reduced IP address, then how would connection work? Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location? On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?
  - akvadrako 8y ago
    Nothing to do with the isp - but if you have users so you know who they are and then you also track people by ip network, you are now storing tracking logs that can be identified with a specific user. For example if hacker news did this and one of your comments contained your city or company, now they can connect your account to an anonymized analytics user.

by grabeh 8y ago

akvadrako 8y ago

Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect. Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.

grabeh 8y ago
If your reference to 'you' means someone running a site who only has possession of a reduced IP address, then how would connection work? Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location? On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?
- akvadrako 8y ago
  Nothing to do with the isp - but if you have users so you know who they are and then you also track people by ip network, you are now storing tracking logs that can be identified with a specific user. For example if hacker news did this and one of your comments contained your city or company, now they can connect your account to an anonymized analytics user.