10 ms·
Ask HN: I collect IP address of users, but do not store it. Am I GDPR compliant?
For a side project of mine, I collect the IP address of users, log it to my server where the country of the user is identified(using ipinfo.io in the backend) and is saved in the database. Since I'm not storing the IP address as such, am I GDPR compliant? Do I need to add a consent banner?
I just store the country name.
- AStonesThrow 2y agoSo, your server is disclosing each address to a third party, in... real time?
- rishikeshs 2y agoNo it’s not. I just store the country of the visitor who initiated an action on the website. There is no login/email or name involved
- AStonesThrow 2y agoSo you're downloading a geolocation database from ipinfo.io, and querying it locally?
- rishikeshs 2y agoSo the frontend pushes it to the backend, a backend fetches the corresponding country using the IP from ipinfo and I store the country in a database. I discard the IP
- LinuxBender 2y agoDoes the IP address leave your server at any point? Are you querying ipinfo.io from their domain using their API or as others have asked, are you downloading the entire database to your server and querying your own server for the IP? If the answer is their API then you are leaking the IP address to a third party. Are you downloading this database [1] and using it locally on your server? [1] - https://ipinfo.io/products/free-ip-database https://ipinfo.io/products/free-ip-database
- rishikeshs 2y agoYes I’m using their API. I get your point. The only reason I collect IP is for knowing location. So if I use browser location, is it allowed?
- deleted 2y ago[deleted]
- LinuxBender 2y agoThis is where I would consult a lawyer. It appears that no matter how granular the data is one must ask the visitor for consent and it gets stricter if the visitor is a child [1]. The site must disclose exactly what it is collecting so in your case it would be the country of origin. Again, I am not a lawyer and will always take the conservative approach to avoid fines so unless there is an official document that states the granularity by country does not apply I would avoid it. [1] - https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/communications-networks-and-services/location-data/#locationdata https://ico.org.uk/for-organisations/direct-marketing-and-pr...
- kazinator 2y agoWhat if you perturbed the last few bits of the address? Let's assume IPv4 for the discussion. Any given IPv4 address, even if subnetted, is going to have a solid 8 bits at the bottom that all belong to the same network, no? If the user is 123.45.67.89 but you actually query the database using 123.45.67.17, you have not divulged the user's IP address. Yet it's vanishingly unlikely it will result through the wrong country. The result could we put into a local cache, where the key is just 123.45.67.X.
- rishikeshs 2y agoThis is an interesting approach. So for every ip, I just remove the last part and fetch country right?
- 2y ago
- znpy 2y agoAfaik as long as it’s not PII (personally-identifying information) you should be fine.
- gnabgib 2y agoIP address is defined in GDPR as PII: https://www.gdpreu.org/the-regulation/key-concepts/personal-data/#Examples_of_Personal_Information https://www.gdpreu.org/the-regulation/key-concepts/personal-... Many other locales say the same: California Consumer Privacy Act: https://iapp.org/news/a/are-ip-addresses-personal-information-under-ccpa/ https://iapp.org/news/a/are-ip-addresses-personal-informatio... Canada PIPEDA: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_02/ https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-can... UK ICO: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
- rishikeshs 2y agoI do not store it. I use it on the fly to identify the country and then discard it.
- reverius42 2y agoSounds like you share it on the fly (with someone who might store it?) and then discard it. The sharing might be problematic.
- rishikeshs 2y agoWhat if I obscure the last 2 digits of the IP
- znpy 2y ago> IP address is defined in GDPR as PII: https://www.gdpreu.org/the-regulation/key-concepts/personal- https://www.gdpreu.org/the-regulation/key-concepts/personal-... According to your link: "Personal data relating to GDPR does not cover: ... Properly anonymized data ..." So OP might could hash the ip address (something better than md5, ideally) and save that.
- JSDevOps 2y agoYou should hire a GDPR consultant
- rishikeshs 2y agoIt’s a side project of mine. Not worth it, probably scrap it instead of that
- meiraleal 2y agoDo it and if it gets big enough fix it
- paulcole 2y agoHard to imagine a bigger waste of money. They’ll just tell you to put up more banners and store less data and then they’ll charge you for it. Evaluate the risk here. It’s a (presumably) small personal/side project. As a person based in the US, I wouldn’t give this a second thought.
- rishikeshs 2y agoYes it’s a small project I did while I was learning programming, but getting some traffic!
- Bender 2y agousing ipinfo.io in the backend I am not a lawyer and this is not legal advice. Are you sending the client IP to a third party API? There are existing questions and answers about this [1] but ultimately as others said one should at least consult a lawyer. It's not even 15 minutes of their time. Consider using lookup tools that download the database [2] to your server to avoid sending the client IP anywhere even if it turns out to be in a gray area to do so. Even if not for a legal reason, technically this removes a real time dependency on a 3rd party website. [1] - https://law.stackexchange.com/questions/57557/does-information-related-to-client-ip-address-is-been-allowed-as-per-gdpr-polici https://law.stackexchange.com/questions/57557/does-informati... [2] - https://ipinfo.io/products/free-ip-database https://ipinfo.io/products/free-ip-database
- ATechGuy 2y agoIf you use Cloudflare workers, they just give you IP addresses and associated info (city/region/country) as metadata. No need to query a third-party service. Not sure if this is GDPR compliant though.
- dangobanned 2y ago[flagged]
- farseer 2y agoSo what if you are a small actor on the web and not GDPR compliant? Who will come knocking at my door?