3 ms·

If the IP address is hashed somehow it would no longer be personally identifying while still being unique enough for analytics purposes, correct? Does geograp

If the IP address is hashed somehow it would no longer be personally identifying while still being unique enough for analytics purposes, correct? Does geographic grouping data depend on the IP address? If so I suppose it would need to be extracted first before hashing the IP, and I wonder how much that weakens the anonymization.

kevin_thibedeau 1y ago
You can hash every IPV4 for a rainbow table. Needs some salt.
- dylan604 1y ago
  Okay, but that doesn't mean the concept is bad.
  - lmkg 1y ago
    Yes it does. If a user can say "here's my IP address, what data do you have on me?" and you can answer that question, then that's personal data under GDPR. It's pseudynomized, but not anonymized, and pseudynomous data is personal data.
    - wizzwizz4 1y ago
      Even if you can't answer that question, if it can be answered, that's still personal data.
      - dylan604 1y ago
        What's the minimum size of an operation before the GDPR kicks in? In other words, are all sites governed by GDPR, or are some companies considered too small to be under the GDPR regulations? I know that there are some regulations that get a pass for smaller outfits. I know nothing about GDPR as a European audience is not my target and not kowtowing for them.
        lmkg 1y ago
        GDPR does not currently have explicit business size thresholds. Its provisions are all framed as personal rights of the data subject, so its provisions are always in effect. By contrast, CCPA in California is framed as a consumer protection law so it only applies to companies of a certain size. In practice, small fries are not an enforcement priority. Regulators in most countries are not well-funded so they have to be frugal with their enforcement actions. The EU is currently reviewing an option to relax GDPR requirements for smaller businesses. Not remove GDPR requirements, just streamline some of the process overhead.
- SquareWheel 1y ago
  According to the author, Rybbit hashes IPs with a daily rotating salt. https://www.reddit.com/r/selfhosted/comments/1kgytl4/i_built_rybbitio_an_open_source_google_analytics/mr2swla/?context=1 https://www.reddit.com/r/selfhosted/comments/1kgytl4/i_built...

kevin_thibedeau 1y ago

You can hash every IPV4 for a rainbow table. Needs some salt.

dylan604 1y ago
Okay, but that doesn't mean the concept is bad.
- lmkg 1y ago
  Yes it does. If a user can say "here's my IP address, what data do you have on me?" and you can answer that question, then that's personal data under GDPR. It's pseudynomized, but not anonymized, and pseudynomous data is personal data.
  - wizzwizz4 1y ago
    Even if you can't answer that question, if it can be answered, that's still personal data.
    - dylan604 1y ago
      What's the minimum size of an operation before the GDPR kicks in? In other words, are all sites governed by GDPR, or are some companies considered too small to be under the GDPR regulations? I know that there are some regulations that get a pass for smaller outfits. I know nothing about GDPR as a European audience is not my target and not kowtowing for them.
      - lmkg 1y ago
        GDPR does not currently have explicit business size thresholds. Its provisions are all framed as personal rights of the data subject, so its provisions are always in effect. By contrast, CCPA in California is framed as a consumer protection law so it only applies to companies of a certain size. In practice, small fries are not an enforcement priority. Regulators in most countries are not well-funded so they have to be frugal with their enforcement actions. The EU is currently reviewing an option to relax GDPR requirements for smaller businesses. Not remove GDPR requirements, just streamline some of the process overhead.
SquareWheel 1y ago
According to the author, Rybbit hashes IPs with a daily rotating salt. https://www.reddit.com/r/selfhosted/comments/1kgytl4/i_built_rybbitio_an_open_source_google_analytics/mr2swla/?context=1 https://www.reddit.com/r/selfhosted/comments/1kgytl4/i_built...