gdpr
Is storing only part(s) of an IP address compliant with the GDPR?
<p>Let's say that ip address is something like xxx.52.114.191. Would be allowed to store into database 113.191? And let's say address is Nick Example, Some street 5, 33012 Florida, US. Would be allowed to store into database ple, eet 5, Florida?</p>

<p>We are having some lottery game at our website that user can try only once. The most reliable way to check if user already tried is to check ip address and home address. Since we are not allowed to store this information into database without consent I was thinking to anonymize ip address by removing first numbers and anonymize address by leaving just last 3 characters in the name and street name. Is that fine?</p>

<blockquote>
  <p>Is storing only part(s) of an IP address compliant with the GDPR?</p>
</blockquote>

<p>Yes. Omitting a portion of the IP address hinders others' ability to identify the natural person who is the data subject. See Article 4 of the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a>.</p>

<blockquote>
  <p>Would I be allowed to store into database ple, eet 5, Florida?</p>
</blockquote>

<p>Yes. The aforementioned rationale applies here. The high likelihood that a street name is used in many locations in a state (e.g., Florida) precludes the identification of a specific natural person if someone else gained access to the version of data you store.</p>

<p>It is noteworthy, though, that storing the state (Florida) might defeat the purpose of omitting the initial portion of the IP address. That is because the distribution of IP addresses has some correspondence with geographical location unless the user is connecting through a VPN. </p>

<p>Accordingly, you might want to assess which part(s) of the IP address is most judicious to omit or devise a different data implementation that enforces the purpose you have in mind (i.e., to prevent a user from making multiple attempts to win the lottery).</p>
