1

I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: Dashboard Screenshot

However, you can click on a user ID (right) like abaer and see information about the user: User Page Screenshot

I assume letting people see the user's IP address is okay, but it also shows them other pages the user has visited across all paperclip-enabled websites, not just yours. My friend says this may be a violation of GDPR. Is this true?

2

Yes

First, an IP address is explicitly personal data and you are sharing it without a legal reason.

Second, anything that can identify a particular person can be personal data. A time sequenced list of visited websites can do this. For example, many people have their company's web page as their home page. So, if that page is being hit a lot it might be an employee. If they are also hitting that company's Facebook, LinkedIn, SharePoint page etc. that's very strong evidence. If its a small company, we've just narrowed it down to say a dozen people. If most of the other sites are state and federal tax sites, banking sites etc. then its probably the CFO - an identifiable person.

  • Doesn't stat counter show IPs? – user21049 Apr 8 at 9:43
  • @ArchieBaer collecting and showing IP addresses is legal – if you have a suitable legal basis. For your analytics software, there's also the question who the data controller is: the website using the analytics, or you as the analytics provider? Answer: you all have full obligation to ensure compliance, which effectively means that no GDPR-compliant can use your analytics. Note that Google Analytics avoids this problem by not sharing analytics data across controllers (by default): the website operator is then the sole controller, and the analytics provider just a processor. – amon Apr 8 at 11:22
  • The only person who can see the IPs through the web interface is on the dashboard for their website. – user21049 Apr 8 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy