4 ms·

Afaik as long as it’s not PII (personally-identifying information) you should be fine.

• gnabgib 2y ago
  IP address is defined in GDPR as PII: https://www.gdpreu.org/the-regulation/key-concepts/personal-data/#Examples_of_Personal_Information https://www.gdpreu.org/the-regulation/key-concepts/personal-... Many other locales say the same: California Consumer Privacy Act: https://iapp.org/news/a/are-ip-addresses-personal-information-under-ccpa/ https://iapp.org/news/a/are-ip-addresses-personal-informatio... Canada PIPEDA: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_02/ https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-can... UK ICO: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
  • rishikeshs 2y ago
    I do not store it. I use it on the fly to identify the country and then discard it.
    • reverius42 2y ago
      Sounds like you share it on the fly (with someone who might store it?) and then discard it. The sharing might be problematic.
      • rishikeshs 2y ago
        What if I obscure the last 2 digits of the IP
  • znpy 2y ago
    > IP address is defined in GDPR as PII: https://www.gdpreu.org/the-regulation/key-concepts/personal- https://www.gdpreu.org/the-regulation/key-concepts/personal-... According to your link: "Personal data relating to GDPR does not cover: ... Properly anonymized data ..." So OP might could hash the ip address (something better than md5, ideally) and save that.
    • johneth 2y ago
      Hashing an IPv4 address doesn't particularly protect privacy, given the limited address space.
      • znpy 2y ago
        In order to be gdpr compliant you need to be able to argue that you anonymized the data. Hashing, possibly with a secret salt, is sufficient.