5 ms·
Correct me if I'm wrong, aren't but IP addresses are considered to be "personal information" and therefore collecting them is "tracking" under the GDPR?
by throw10920 3y ago
Correct me if I'm wrong, aren't but IP addresses are considered to be "personal information" and therefore collecting them is "tracking" under the GDPR?
- oneeyedpigeon 3y agoMy guess is that they are because ISPs may keep records of them—I think they are required to in some jurisdictions. But you don't have to store IPs in your server logs.
- IanCal 3y agoYou're also allowed to store IP addresses in your logs, you just have to take care with the data and the reason you're storing them needs to be justified - either because you have a legitimate interest in doing so (e.g. security) or because you have my explicit consent. If I order something from an online shop, they don't need to have a banner in order to take my name and address to post the item to me - that's fully expected and reasonable. They do need my consent if they want to use that to post adverts to me though.
- IanCal 3y agoYes but it depends what you're doing with them as to whether you need consent. If you're keeping a record of my IP address and what I do on your site to sell me stuff then yes you're tracking me and need my consent for that. If you've got my IP address in your logs because you keep security logs for reasonable timeframes then you don't need my consent - though you do need to handle them appropriately because it's my personal data.
- thomastjeffery 3y agoWhat else would you need my IP address for?
- throw10920 3y agoUh...DDoS and spam protection?
- yau8edq12i 3y agoThen store it for that purpose, don't use it for anything else, and delete it when it's not useful anymore (realistically, for these purposes, after a few minutes to an hour?).
- tekknik 3y agoOk so now a criminal just needs to avoid being detected for an hour and the logs are self wiping. Sounds like a feature they’ll love!
- IanCal 3y agoKeep them as long as is reasonable, then delete them.
- tekknik 3y agoReasonable means different things in different countries and industries. Some require 14 years of retention.
- IanCal 3y agoAbsolutely, and gdpr doesn't get in the way of those legal obligations. The point is that you can do what is necessary or expected to provide the service without consent, and you can do much more with consent.
- yau8edq12i 3y agoI thought this was about DDOS and spam protection. If you want to move the goalposts, state that explicitly.
- 3y ago