3 ms·
> `/ip=([\d.]*)\n/` 1. This is going to break if your clients are using IPv6. 2. IP addresses are generally considered PII under GDPR[0], but IANAL and I don'
by jwalton 6y ago
> `/ip=([\d.]*)\n/`
1. This is going to break if your clients are using IPv6.
2. IP addresses are generally considered PII under GDPR[0], but IANAL and I don't know what that means as far as compliance.
[0](https://www.groundlabs.com/blog/what-is-pii-for-gdpr/ https://www.groundlabs.com/blog/what-is-pii-for-gdpr/)
- dannyw 6y agoIf you hash your IP with a bunch of other fairly unpredictable and high cardinality information; it's no longer PII.
- dvdkhlng 6y agoThey are are using a 53-bit hash cyrb53 [1] of the string "IP address + website domain + user agent + language + validity days". It looks feasible that many of the generated IDs could be retroactively brute-force mapped back to an IPv4 address with high confidence (small chance of error due to hash collisions). [1] https://stackoverflow.com/questions/7616461/generate-a-hash-from-string-in-javascript/52171480#52171480 https://stackoverflow.com/questions/7616461/generate-a-hash-...
- grabeh 6y agoI wouldn't trust any article that purports to be about GDPR that uses the term 'PII' a term which itself isn't anywhere to be seen in the regulation! In reality an IP address is generally not PII, but it may be personal data - the case is Breyer which was decided on pre-GDPR law but still relevant. If you could use reasonable means to identify someone from the IP address then it will be personal data. I don't really agree with the outcome of the case because it implied it was easy to contact an ISP to get them to disclose details of the subscriber information associated with the IP address. In the UK at least it would require cause, and a court order.