0

We need implement user's nearby store locator. Where we have code to get user's ISP location from where the client request is been triggered.

But getting lat-long & city details by checking client browser IP address. Even if user don't allow website to share user's current location.

Does above doing violates any of GDPR policy?

Please share your views.

Thanks.

5
  • This is a purely legal question. Please ask at Law.
    – Steffen Ullrich
    Oct 29, 2020 at 7:33
  • Thanks will do same.
    – WC2
    Oct 29, 2020 at 7:35
  • 2
    Client IP address is not a good source of location information - it can be registered to a physical address hundreds or thousands of miles from the users actual location. Plus they may be using a VPN. The legal side of this question is the least of your worries, in my opinion.
    – user28517
    Oct 29, 2020 at 8:38
  • @Moo: For a "store locator", reliability does not matter. It's a convenience option to pre-select a likely choice. With or without VPN, you other choices to remain available.
    – MSalters
    Oct 30, 2020 at 13:00
  • @MSalters “nearby” doesnt help when your IPs registered address is hundreds of miles away. Im currently in NZ, my ISPs registered address for my static IP is on a totally different island, about 800 miles away. What counts as “nearby”? You show me stores for a location 800 miles away, Im going to laugh at your UX. Client IP remains a bad source of location information.
    – user28517
    Oct 30, 2020 at 16:50

2 Answers 2

3

You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor.

You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify).

If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.

0

When using IP addresses, there are two EU laws to consider:

  • GDPR regulates the use of personal information, which includes online identifiers. IP addresses are likely to be personal data in this context. Processing personal data requires a legal basis, such as a legitimate interest or consent. When relying on consent you cannot reuse the data for a different purpose. You must be transparent about the processing of personal data, ideally using a layered information approach: the first layer summarizes information just before processing takes place, and a second layer provides the full privacy policy.

  • The ePrivacy directive instructs EU member states to implement certain laws regarding electronic communications. It introduces the concept of traffic data, which includes IP addresses. Traffic data can only be processed for the purpose of providing the service requested by the user, or when the data is anonymized, or when the user consents. Similarly, you can only access information on the user's device if it is strictly necessary for the service, or if the user consents.

Using the IP address for geolocation would e.g. be okay

  • if the user requested this service (necessary under ePrivacy, legitimate interest under GDPR); or
  • if the user consents to this use.

If you use third party services to perform the geolocation, they should be bound as your data processor, or you should only send anonymized data to the services (e.g. redacting some bytes of the address, or mixing with plausible but random addresses)

However, IP geolocation is extremely unreliable in Europe. Country-level location is generally fine, but city-level location rarely works – I'm often shown locations up to 200km away (this depends a lot on the ISP). Thus, it might be better to offer different approaches:

  • show a map of the whole country to the user, and let them zoom in themselves
  • use a search box where they can enter town names
  • ask for the postcode and show nearby stores in that area
  • for mobile devices: ask for consent to access GPS location

Postcode lookup can be performed entirely client side and would be one of the most privacy-preserving approaches.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .