2

My question is: how is it possible calculate visitors per day without gathering some information about the users in order to be able to identify them as revisits?

We have a cookie consent banner in our site, if a user clicks to choose to accept analytics cookie then we are good, but how about the people that don't give consent?

I heard something like this before: "Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function."

But by hashing a IP address you process the personal information and that you can't do without the user's permission!

Is it possible to do this legally? If so, how?

1
  • 1
    I do not see what additional details are needed to make this a suitable question for answering here. I don't think this should be closed as lacking details or clarity. Sep 17 '21 at 17:27
3

The question says:

But by hashing a IP address you process the personal information and that you can't do without the user's permission!

But processing personal data (PI) is covered not by the e-Privacy Directive (ePD) but by the GDPR. Under the GDPR processing may be lawful if it is done under any of the six lawful bases specified by Article 6. Consent is one of these. But paragraph (f) permits processing when:

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject ...

This is generally known as the "legitimate interest" basis for processing. It normally requires a balancing against the privacy interests of the data subject. Where, as here, the processing is specifically to remove any traceability of the subject, and hence to protect the privacy of the subject, there doesn't seem to be much conflict, so I suspect such processing would be lawful.

I have not found, after a brief search, an actual case where this has been tested, so my conclusion might be mistaken.

Personal Data under the GDPR and hashing

GDPR Quotes

Article 4 of the GDPR defines "Personal data" (in paragraph (1) as follows:

personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The term "pseudonymisation" is defined in paragraph 5 of article 4 as follows:

‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

GDPR recital 26 reads:

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Hashing

If a cryptographically secure hash function is used to convert an identifier, such as an IP address, into a replacement hash, there is no practical way from the hash value alone to recover the identifier.

However, if a particular identifier value is compared with a stored hash value, it is easy to tell if there is a match. Finding a match does not prove that the identifier is the same -- depending on the length of the hash value being used and of the identifier, there may be many values that would give the same hash. But the chance of two random IDs having matching hashes is very small.

Thus, if a controller were to store hashed versions of the IP addresses, no one could convert that back to a list of visiting IP addresses. But if soemoen had the IP address of a suspected visitor, and access to the hash function, it would be easy to check if that IP was on the list. If a keyed hash function were used, only someone with access to the key could perform this check.

It is not feasible to hash all possible IP addresses as there are over 4 billion possible IPv4 addresses, and over 10^38 IPv6 addresses (over one thousand decillion). Thus creating a table to reverse the hashing in general is not feasible.

Whether the possibility of checking for a match makes a hashed IP "reasonably identifiable" as representing a specific natural person under the GDPR and related laws has not, as far as I know, been authoritatively decided. Note that at most it would reveal that a person using a certain internet connection had (probably) visited a particular site.

2
  • An IP address is both personal data covered by GDPR, and traffic data covered by ePrivacy. Under ePrivacy, using traffic data is only allowed with consent, for billing purposes, and when anonymized. To determine what counts as anonymization we probably have to look back at the GDPR (and I have severe doubts if mere hashing is sufficient, especially given the arguments in the recent EDPB dispute resolution document regarding WhatsApp's hashing of phone numbers). But I would agree that there is a legitimate interest to perform anonymization.
    – amon
    Sep 17 '21 at 20:22
  • 1
    Thank you for the edits! You're right that the IPv6 address space cannot be brute forced, but IPv4 is only 32 bits. A rainbow table would only be a few GB, but is unnecessary as this space can be easily brute-forced within minutes on consumer hardware. It will be significantly faster if the structure of addresses is taken into account. So at least when hashing IPv4 addresses, there are means reasonably likely to be used to reverse the hashing, meaning that hashing would only be a pseudonymization method.
    – amon
    Sep 18 '21 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.