3 ms·

I am curious, how are you going to unanonymise an IP to something that could have 255 combinations (and that's just if you drop that last part on an IPv4). Neve

I am curious, how are you going to unanonymise an IP to something that could have 255 combinations (and that's just if you drop that last part on an IPv4). Nevermind that an IP alone is not PII. How can you reverse something that has many possibilties?

donohoe 6y ago
>> IP alone is not PII It is in Europe, despite some regional rulings (Germany?). It is not considered PII in the USA.
- fmajid 6y ago
  IP addresses are also explicitly considered PII by California’s CCPA. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm... (o) (1) “Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following: (A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
  - that_guy_iain 6y ago
    Just to be that guy. There is a slight difference between Personal Identifying Information and Personal Information.
  - donohoe 6y ago
    That was true once. Longer answer "it depends": “[I]f a business collects the IP addresses of visitors to its websites but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information.” Source: https://iapp.org/news/a/are-ip-addresses-personal-information-under-ccpa/ https://iapp.org/news/a/are-ip-addresses-personal-informatio...
    - fmajid 6y ago
      You missed the paragraph: "However, when the attorney general revised its draft regulations for a second time March 11, the guidance was struck without explanation."
- that_guy_iain 6y ago
  GDPR is EU law. So the regional rulings are extremely important for deciding what you think you can and can't do. And I think we're missing the main point. How can it be reversed if there are hundreds of possibilites.

donohoe 6y ago

>> IP alone is not PII It is in Europe, despite some regional rulings (Germany?). It is not considered PII in the USA.

fmajid 6y ago
IP addresses are also explicitly considered PII by California’s CCPA. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm... (o) (1) “Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following: (A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
- that_guy_iain 6y ago
  Just to be that guy. There is a slight difference between Personal Identifying Information and Personal Information.
- donohoe 6y ago
  That was true once. Longer answer "it depends": “[I]f a business collects the IP addresses of visitors to its websites but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information.” Source: https://iapp.org/news/a/are-ip-addresses-personal-information-under-ccpa/ https://iapp.org/news/a/are-ip-addresses-personal-informatio...
  - fmajid 6y ago
    You missed the paragraph: "However, when the attorney general revised its draft regulations for a second time March 11, the guidance was struck without explanation."
that_guy_iain 6y ago
GDPR is EU law. So the regional rulings are extremely important for deciding what you think you can and can't do. And I think we're missing the main point. How can it be reversed if there are hundreds of possibilites.