Hacker News Reader

Google Analytics drops the last octet IIRC. Hashing isn't anonymizing because the hash can later be used to re-identify a user. (See https://ec.europa.eu/info/law/law-topic/data-protection/refo...)

View on HN

Since there are legitimate use-cases where you need to be able to somehow identify requests coming from the same IP (protection against DDoS), you would be allowed to do it, given that you take reasonable steps to protect the user (such as deleting the logs after a few days when there's no suspicious activity).

And then hashing the IP addresses would be such a reasonable step, too, since it removes location information from the stored data.

Reply on news.ycombinator.com