I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: Dashboard Screenshot

However, you can click on a user ID (right) like abaer and see information about the user: User Page Screenshot

I assume letting people see the user's IP address is okay, but it also shows them other pages the user has visited across all paperclip-enabled websites, not just yours. My friend says this may be a violation of GDPR. Is this true?



First, an IP address is explicitly personal data and you are sharing it without a legal reason.

Second, anything that can identify a particular person can be personal data. A time sequenced list of visited websites can do this. For example, many people have their company's web page as their home page. So, if that page is being hit a lot it might be an employee. If they are also hitting that company's Facebook, LinkedIn, SharePoint page etc. that's very strong evidence. If its a small company, we've just narrowed it down to say a dozen people. If most of the other sites are state and federal tax sites, banking sites etc. then its probably the CFO - an identifiable person.

  • Doesn't stat counter show IPs? – Archie Baer Apr 8 at 9:43
  • @ArchieBaer collecting and showing IP addresses is legal – if you have a suitable legal basis. For your analytics software, there's also the question who the data controller is: the website using the analytics, or you as the analytics provider? Answer: you all have full obligation to ensure compliance, which effectively means that no GDPR-compliant can use your analytics. Note that Google Analytics avoids this problem by not sharing analytics data across controllers (by default): the website operator is then the sole controller, and the analytics provider just a processor. – amon Apr 8 at 11:22
  • The only person who can see the IPs through the web interface is on the dashboard for their website. – Archie Baer Apr 8 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.