Suppose a web designer plans to use IPs for security purposes to prevent botting unique clicks and brute force attempts. And, the site only stores a hash of the IP address for a limited amount of time and then automatically deletes it.

Would such a design be GDPR compliant?

  • 1
    Besides the legal point, IPs are super easily spoofed and can be shared by thousands of people: anyone going through a university network shares the same IP while on campus, anyone using a VPN shares with a few hundred machines...
    – Trish
    Apr 27, 2023 at 7:16
  • 1
    It's not necessarily unlawful to use any personal data. What you must do is consider your 'lawful basis' for using the personal data. The UK's ICO has some guidance here: ico.org.uk/for-organisations/guide-to-data-protection/…
    – Lag
    Apr 27, 2023 at 12:00
  • Note that you could easily brute force an IP from any hash, at least IPv4.
    – forest
    May 22, 2023 at 5:52

1 Answer 1


Whether a hash of PII is still PII can certainly be debated at a court of law. Especially since you want to store information identifying the idividual. That is the whole purpose of it. Storing information identifying a person, so they cannot vote twice.

But the GDPR is not a law to prevent you from doing things. All you need to do is get consent. Explain that their data will only be kept as long as neccessary for the stated purpose and then be deleted and ask for the users consent to save their data.

It's probably enough to set a little checkbox and an explanation text.

If they do not agree to have their data saved for this timespan and purpose, they cannot vote.

  • 2
    The hash would almost certainly be personal data, since it makes it possible to single out one person's actions, even if it's not directly identifying. Consent is not the only available legal basis. For security measures, a "legitimate interest" would typically be more appropriate. Of course it still requires transparent information about the processing activities. While a legitimate interest typically requires offering an opt-out, opt-out requests for security measures can probably be rejected.
    – amon
    Apr 27, 2023 at 13:07
  • There is no "legitimate interest" if I just surf to the site. Only if I want to use the poll. And you have to inform them anyway, legitimate interest or not. So for me, if I need to build that all anyway to comply, the whole logic to only save if the user says they want to use the poll, you can as well make it consent-based, since all technical means being of the same complexity, consent is something I don't have to justify or explain. So it seems to me the simpler option. But yes, if the simpler option weren't available, "legitimate interest to protect against fraud" would work, too.
    – nvoigt
    Apr 28, 2023 at 6:22
  • I agree that just using consent for everything would be possible. My concern with that would be what happens if consent is withdrawn. If you also base the security measures on this consent, you'll have to delete data needed for security measures. Especially if consent revocation is automated, this would make it possible to circumvent rate limits. "Consent is something I don't have to justify or explain" seems to forget that consent must be "informed" and "specific", and that controllers must be able to demonstrate that they've obtained valid consent.
    – amon
    Apr 29, 2023 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .