1

We are trying to log the location of our visitors, without storing their actual IP address on our servers.

To geolocate the IP address, we use an external service, to which we make an API request with the user's IP, and the service returns the approximate geolocation we store in our database.

The service is not 100% accurate, more than often it just points to the provider's exchange location For us this is enough since it is usually in the same city as the original ip address.

Is passing the user's IP address to the external service for processing considered okay without the user's explicit consent under the GDPR?

  • Is the geolocation service a Data Processor of yours? – amon Jan 17 at 14:43
1

Consent in one reason - there are 6 others

However, your usage doesn’t appear to fall within any of them so consent is required. Further, unless your service won’t work without this, you cannot deny access if consent isn’t given.

0

Is passing the user's IP address to the external service for processing considered okay without the user's explicit consent under the GDPR?

That is okay provided that:

Whereas an IP address in your possession may relate to an identified or identifiable natural person (by means of you having other data that allows to map the IP address to a particular person), passing the IP address alone to an external service will likely not allow them to figure out what person it belongs to. This IP address is therefore anonymous data to which GDPR does not apply.

* Barring the cases where a person in the EU uses VPN outside of the EU.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.