5 ms·

"We don't use cookies or collect any personal data." IP-address is considered personal data. So when the browsers visits a page with the JS, the IP-address of

"We don't use cookies or collect any personal data." IP-address is considered personal data. So when the browsers visits a page with the JS, the IP-address of the user is transferred to your server. So that means the website I am visiting is sharing my IP-address with a third-party (you).

xrisk 8y ago
The IP address isn't stored though.
- sleepyhead 8y ago
  I don't think that is relevant. What matters is that it is transferred to a third-party. And regardless if it is stored in a database, the servers are still processing the data (and maybe storing the log of it).
  - LyndsySimon 8y ago
    How would you do analytics without the IP address being "transferred to a third party"? Outside of self-hosting, either the user's browser is going to be making a request to the analytics provider (and therefore exposes their IP), or you're going to have to have some sort of proxy mechanism on the site's server that strips that information and sends it from there. Am I missing something?
    - ecnahc515 8y ago
      It's exactly as you state. This is the problem. The IP address needs to be stripped before storing or sending to anyone else, or it's still something you need to consider as personal data. This matters for GDPR. So in effect, this service still has to adhere to GDPR, because it is in fact receiving IP addresses, regardless of them getting stored or not.
      - iDemonix 8y ago
        GDPR bores the hole off of me so I haven't done much reading, but I do remember a court dismissing a piracy case recently because 'IP addresses alone are not enough to identify an individual' - how would this play in to this scenario?
  - SahAssar 8y ago
    At least under GDPR the relevant question is if it is stored and who it is shared with. So if it is not stored/shared then it should be fine legally.
alkonaut 8y ago
Would it make a difference If the information was anonymized /hashed?
- sleepyhead 8y ago
  Only if there is no way to identify the user. A hash or anonymised id is still personal data if you can identify a person with it.

xrisk 8y ago

The IP address isn't stored though.

sleepyhead 8y ago
I don't think that is relevant. What matters is that it is transferred to a third-party. And regardless if it is stored in a database, the servers are still processing the data (and maybe storing the log of it).
- LyndsySimon 8y ago
  How would you do analytics without the IP address being "transferred to a third party"? Outside of self-hosting, either the user's browser is going to be making a request to the analytics provider (and therefore exposes their IP), or you're going to have to have some sort of proxy mechanism on the site's server that strips that information and sends it from there. Am I missing something?
  - ecnahc515 8y ago
    It's exactly as you state. This is the problem. The IP address needs to be stripped before storing or sending to anyone else, or it's still something you need to consider as personal data. This matters for GDPR. So in effect, this service still has to adhere to GDPR, because it is in fact receiving IP addresses, regardless of them getting stored or not.
    - iDemonix 8y ago
      GDPR bores the hole off of me so I haven't done much reading, but I do remember a court dismissing a piracy case recently because 'IP addresses alone are not enough to identify an individual' - how would this play in to this scenario?
- SahAssar 8y ago
  At least under GDPR the relevant question is if it is stored and who it is shared with. So if it is not stored/shared then it should be fine legally.

alkonaut 8y ago

Would it make a difference If the information was anonymized /hashed?

sleepyhead 8y ago
Only if there is no way to identify the user. A hash or anonymised id is still personal data if you can identify a person with it.