privacy gdpr european-union
Is anonymous analytics data subject to GDPR?
<p>I am reading the definition of "personal data" here <a href="https://gdpr-info.eu/issues/personal-data/" rel="nofollow noreferrer">https://gdpr-info.eu/issues/personal-data/</a>. My understanding is that GDPR comes into play when information is about personal data.</p>

<p>Let's say there is an app similar to clicky.com. It saves three things about visitors: <code>IP</code>, <code>browser</code> and <code>OS information</code>. The app does not have emails, real names, addresses or other info about the visitors.</p>

<p>If the app is anonymizing IP addresses before saving data, it means that browser and OS info can no longer be assigned to a real person.</p>

<p>In other words, there is no way we can say that this information belong to that particular real "person".</p>

<p>Does it mean that the app is GDPR compliant for this particular purpose?</p>

<p>The app is likely GDPR compliant. <strong>However</strong> the organization has a remaining obligation, namely that of Art 11.2 GDPR. A user who can show exclusive control of that IP address (i.e. that the IP address uniquely identifies him or her) still has the usual GDPR rights. </p>

<p>It is not necessary to offer these rights via the app itself. Another reasonable mechanism such as a website can be used. After all, establishing that exclusive control of an IP address is hard, especially in the era of Carrier Grade Network Address Translation (CG-NAT). </p>

<p>You would have to look at whether the way you anonymize the IPs. If there is a way to decipher what they originally were, you are not GDPR compliant. </p>

<p>That could technically even included being able to feed random IP addresses into the algorithm until you got a match, if they are not randomized. </p>
