Process IP address without GDPR consent

Question

We are trying to log the location of our visitors, without storing their actual IP address on our servers.

To geolocate the IP address, we use an external service, to which we make an API request with the user's IP, and the service returns the approximate geolocation we store in our database.

The service is not 100% accurate, more than often it just points to the provider's exchange location For us this is enough since it is usually in the same city as the original ip address.

Is passing the user's IP address to the external service for processing considered okay without the user's explicit consent under the GDPR?

Answer 1

Consent in one reason - there are 6 others

However, your usage doesn’t appear to fall within any of them so consent is required. Further, unless your service won’t work without this, you cannot deny access if consent isn’t given.

Answer 2

Is passing the user's IP address to the external service for processing considered okay without the user's explicit consent under the GDPR?

That is okay provided that:

• The IP address is no personal data (i.e. it does not relate to an identified or identifiable natural person); OR
• The IP address is not from the EU* (only persons in the EU are protected by GDPR).

Whereas an IP address in your possession may relate to an identified or identifiable natural person (by means of you having other data that allows to map the IP address to a particular person), passing the IP address alone to an external service will likely not allow them to figure out what person it belongs to. This IP address is therefore anonymous data to which GDPR does not apply.

* Barring the cases where a person in the EU uses VPN outside of the EU.