Does information related to client IP address is been allowed as per GDPR policies. Without asking user's location

Question

We need implement user's nearby store locator. Where we have code to get user's ISP location from where the client request is been triggered.

But getting lat-long & city details by checking client browser IP address. Even if user don't allow website to share user's current location.

Does above doing violates any of GDPR policy?

Please share your views.

Thanks.

Answer 1

You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor.

You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify).

If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.

Answer 2

When using IP addresses, there are two EU laws to consider:

• GDPR regulates the use of personal information, which includes online identifiers. IP addresses are likely to be personal data in this context. Processing personal data requires a legal basis, such as a legitimate interest or consent. When relying on consent you cannot reuse the data for a different purpose. You must be transparent about the processing of personal data, ideally using a layered information approach: the first layer summarizes information just before processing takes place, and a second layer provides the full privacy policy.

• The ePrivacy directive instructs EU member states to implement certain laws regarding electronic communications. It introduces the concept of traffic data, which includes IP addresses. Traffic data can only be processed for the purpose of providing the service requested by the user, or when the data is anonymized, or when the user consents. Similarly, you can only access information on the user's device if it is strictly necessary for the service, or if the user consents.

Using the IP address for geolocation would e.g. be okay

• if the user requested this service (necessary under ePrivacy, legitimate interest under GDPR); or
• if the user consents to this use.

If you use third party services to perform the geolocation, they should be bound as your data processor, or you should only send anonymized data to the services (e.g. redacting some bytes of the address, or mixing with plausible but random addresses)

However, IP geolocation is extremely unreliable in Europe. Country-level location is generally fine, but city-level location rarely works – I'm often shown locations up to 200km away (this depends a lot on the ISP). Thus, it might be better to offer different approaches:

• show a map of the whole country to the user, and let them zoom in themselves
• use a search box where they can enter town names
• ask for the postcode and show nearby stores in that area
• for mobile devices: ask for consent to access GPS location

Postcode lookup can be performed entirely client side and would be one of the most privacy-preserving approaches.