gdpr european-union
Utilizing Browser IP for Service Security
<p>Suppose a web designer plans to use IPs for security purposes to prevent botting unique clicks and brute force attempts. And, the site only stores a hash of the IP address for a limited amount of time and then automatically deletes it.</p>
<p>Would such a design be GDPR compliant?</p>

<p>Whether a hash of PII is still PII can certainly be debated at a court of law. Especially since you <em>want</em> to store information identifying the idividual. That is the whole purpose of it. Storing information identifying a person, so they cannot vote twice.</p>
<p>But the GDPR is not a law to prevent you from doing things. All you need to do is get <strong>consent</strong>. Explain that their data will only be kept as long as neccessary for the stated purpose and then be deleted and ask for the users consent to save their data.</p>
<p>It's probably enough to set a little checkbox and an explanation text.</p>
<p>If they do not agree to have their data saved for this timespan and purpose, they cannot vote.</p>
