Glossary · Privacy & compliance
What is IP anonymization?
IP anonymization is the practice of removing, truncating or otherwise obscuring a visitor's IP address in an analytics or logging system so the stored data can't be traced back to a specific connection.
Also called: IP masking, IP truncation
Updated
Common IP anonymization methods
| Method | What's stored | Strength |
|---|---|---|
| Truncation | 203.0.113.0 instead of 203.0.113.47 (last octet zeroed) | Weak-moderate: a block of 256 addresses |
| Hashing | A one-way hash of the IP | Weak alone: IPv4 has ~4.3 billion values, easy to brute-force |
| Salted, rotating hash | A hash with a secret salt that's deleted daily | Strong for linking: can't be reversed or joined across days |
| Not storing | Only derived values (country, city) | Strongest: nothing to leak |
IP anonymization example
Universal Analytics offered anonymizeIp, which zeroed the last octet of IPv4 addresses before storage. Google states that Google Analytics 4 doesn't log or store IP addresses. Either way, the full IP still reaches the vendor's servers before it's masked — which is why regulators look at the whole flow, not just storage.
Why masking isn't anonymity
Under GDPR, data is only anonymous if no one can reasonably re-identify the person. A truncated IP combined with a timestamp, user agent and pages visited may still single someone out, and an unsalted hash of an IP can be reversed in minutes. Most masked or hashed data is therefore pseudonymous — still personal data, with lower risk. Only aggregated or properly irreversible data is anonymous.
Common pitfalls
- Assuming truncation makes GDPR not apply.
- Masking in the analytics database while full IPs sit in web server, CDN or error-tracking logs.
- Hashing without a secret salt.
- Forgetting IPv6, where truncating one segment leaves far more identifying information.
How VisitTrack handles IP addresses
VisitTrack doesn't store IP addresses at all — there's no IP column in its visitor, session or event tables. The IP is used in memory to look up an approximate country, region and city, to check for hosting-provider networks in bot filtering, and in cookieless mode as one input to a visitor hash with a salt that changes every day. The network-burst bot rule uses a daily-changing hash of the network, which can't be linked across sites.
Frequently asked questions
Does IP anonymization make analytics GDPR compliant?
Not on its own. Truncated or hashed IPs are usually still personal data under GDPR because they can be combined with other data. It reduces risk, but you still need a lawful basis, transparency and, where ePrivacy applies, consent for device storage.
Does Google Analytics 4 anonymize IP addresses?
Google says GA4 doesn't log or store IP addresses, and the anonymizeIp setting from Universal Analytics no longer exists. The IP is still transmitted to Google when the tag sends data.
Related terms
- GDPRGDPR, the General Data Protection Regulation (Regulation (EU) 2016/679), is the European Union law that governs how personal data about people in the EU is collected, used and stored, in force since May 25, 2018.
- Cookieless trackingCookieless tracking is web analytics that counts visitors without storing any identifier on the visitor's device — no cookies, localStorage or similar — typically by deriving a short-lived anonymous id on the server instead.
- Browser fingerprintingBrowser fingerprinting is a technique that identifies or tracks a device by combining many of its observable characteristics — user agent, screen size, installed fonts, time zone, graphics hardware, audio and canvas rendering — into an identifier that persists without cookies.
- Bot trafficBot traffic is any website visit made by automated software rather than a person — search crawlers, AI crawlers, uptime monitors, scrapers, headless browsers and spam bots.
- Server-side trackingServer-side tracking is sending analytics or conversion events from your own server to the analytics or ad platform, instead of (or in addition to) from a script running in the visitor's browser.
Tools and guides
See which channels actually bring paying customers
VisitTrack is cookie-free analytics with revenue attribution built in. One script tag, no consent banner, live in two minutes. 14 days free, no card required.