I'm designing a special tracking service for my web applications. Its sole purpose is to detect malicious activities and block/list source IP addresses. The thing is that to effectively implement this I'd need to track user sessions, storing hashed IPs and browser fingerprints to database, which are to be removed when a session ends and no malicious actions were detected. Is user consent required for such tracking to function according to GDPR and CCPA?

  • 2
    "user sessions", "fingerprints", "IPs" – all of that sounds like you have identifiers that make the users non-anonymous as far as the GDPR is concerned. But just because it's "personal data" doesn't mean it's illegal or would need "consent". Here, a "legitimate interest" would be worth considering. Also note that the EU ePrivacy Directive usually requires consent when accessing any information on the end users device (e.g. for fingerprinting, even if anonymous) – but not if this is "strictly necessary" to provide the service. Anti-abuse measures might be strictly necessary.
    – amon
    Commented May 12 at 19:46
  • Yow! Why the down votes? :D Commented May 12 at 20:37
  • @amon Thanks for the informative comment! Do you know whether the same exception with strictly necessary tracking apply in US laws? Commented May 12 at 20:42
  • @SubtleDevelopmentSpace my guess is that the downvotes are because your question demonstrates that you have not done even the most basic of research. For example, if you had searched this site and read the relevant Q&A, you'd know the answer.
    – Dale M
    Commented May 13 at 2:08
  • Which specific part demonstrates lack of basic research? This is a more specific case and it's natural to have questions regarding it. I'm pretty sure I'm not the only one to have "stupid" questions like that. What is considered to be very basic research anyway? At least give a damn opportunity to fix the question... Commented May 13 at 11:27

1 Answer 1


You are collecting personal information, so you are a Data Controller under the GDPR

You need a lawful basis for the processing.

There are six available lawful bases for processing. No single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual.

Most lawful bases require that processing is ‘necessary’ for a specific purpose. If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis.

You must determine your lawful basis before you begin processing, and you should document it.

Consent is a legitimate lawful basis, but it is not the only one and possibly not the most appropriate.

  • Thanks for the answer, it's pretty informative. It does answer my question in way, that under GDPR the consent is not necessary if you have any other lawful basis for processing. But I cannot accept this as you didn't mention nothing about CCPA. Commented May 13 at 11:50

Not the answer you're looking for? Browse other questions tagged .