4 ms·

Does the IP address leave your server at any point? Are you querying ipinfo.io from their domain using their API or as others have asked, are you downloading t

Does the IP address leave your server at any point? Are you querying ipinfo.io from their domain using their API or as others have asked, are you downloading the entire database to your server and querying your own server for the IP? If the answer is their API then you are leaking the IP address to a third party. Are you downloading this database [1] and using it locally on your server? [1] - https://ipinfo.io/products/free-ip-database https://ipinfo.io/products/free-ip-database

rishikeshs 2y ago
Yes I’m using their API. I get your point. The only reason I collect IP is for knowing location. So if I use browser location, is it allowed?
- deleted 2y ago
  [deleted]
- LinuxBender 2y ago
  This is where I would consult a lawyer. It appears that no matter how granular the data is one must ask the visitor for consent and it gets stricter if the visitor is a child [1]. The site must disclose exactly what it is collecting so in your case it would be the country of origin. Again, I am not a lawyer and will always take the conservative approach to avoid fines so unless there is an official document that states the granularity by country does not apply I would avoid it. [1] - https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/communications-networks-and-services/location-data/#locationdata https://ico.org.uk/for-organisations/direct-marketing-and-pr...
- kazinator 2y ago
  What if you perturbed the last few bits of the address? Let's assume IPv4 for the discussion. Any given IPv4 address, even if subnetted, is going to have a solid 8 bits at the bottom that all belong to the same network, no? If the user is 123.45.67.89 but you actually query the database using 123.45.67.17, you have not divulged the user's IP address. Yet it's vanishingly unlikely it will result through the wrong country. The result could we put into a local cache, where the key is just 123.45.67.X.
  - rishikeshs 2y ago
    This is an interesting approach. So for every ip, I just remove the last part and fetch country right?
    - kazinator 2y ago
      There are probably downsides, such as the IP still indicating a particular neighborhood in a particular city. Or a company or institution.
      - Bender 2y ago
        Agreed, this is why I would get advice from a lawyer because a /24 is still a very specific location and GDPR uses vague language about location.

rishikeshs 2y ago

Yes I’m using their API. I get your point. The only reason I collect IP is for knowing location. So if I use browser location, is it allowed?

deleted 2y ago
[deleted]
LinuxBender 2y ago
This is where I would consult a lawyer. It appears that no matter how granular the data is one must ask the visitor for consent and it gets stricter if the visitor is a child [1]. The site must disclose exactly what it is collecting so in your case it would be the country of origin. Again, I am not a lawyer and will always take the conservative approach to avoid fines so unless there is an official document that states the granularity by country does not apply I would avoid it. [1] - https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/communications-networks-and-services/location-data/#locationdata https://ico.org.uk/for-organisations/direct-marketing-and-pr...
kazinator 2y ago
What if you perturbed the last few bits of the address? Let's assume IPv4 for the discussion. Any given IPv4 address, even if subnetted, is going to have a solid 8 bits at the bottom that all belong to the same network, no? If the user is 123.45.67.89 but you actually query the database using 123.45.67.17, you have not divulged the user's IP address. Yet it's vanishingly unlikely it will result through the wrong country. The result could we put into a local cache, where the key is just 123.45.67.X.
- rishikeshs 2y ago
  This is an interesting approach. So for every ip, I just remove the last part and fetch country right?
  - kazinator 2y ago
    There are probably downsides, such as the IP still indicating a particular neighborhood in a particular city. Or a company or institution.
    - Bender 2y ago
      Agreed, this is why I would get advice from a lawyer because a /24 is still a very specific location and GDPR uses vague language about location.