gdpr
Does allowing users to see user tracking on my analytics software violate GDPR?
<p>I'm not really sure what to title this question, but I've built an analytics software, <a href="https://paperclip.live" rel="nofollow noreferrer">Paperclip</a>, and this is the dashboard: <img src="https://i.stack.imgur.com/Vyqbx.png" alt="Dashboard Screenshot"></p>

<p>However, you can click on a user ID (right) like <code>abaer</code> and see information about the user: <img src="https://i.stack.imgur.com/Aocuw.png" alt="User Page Screenshot"></p>

<p>I assume letting people see the user's IP address is okay, but it also shows them other pages the user has visited across <strong>all paperclip-enabled websites, not just yours</strong>. My friend says this may be a violation of GDPR. Is this true?</p>

<h2>Yes</h2>

<p>First, an IP address is explicitly personal data and you are sharing it without a legal reason.</p>

<p>Second, anything that can identify a particular person can be personal data. A time sequenced list of visited websites can do this. For example, many people have their company's web page as their home page. So, if that page is being hit a lot it might be an employee. If they are also hitting that company's Facebook, LinkedIn, SharePoint page etc. that's very strong evidence. If its a small company, we've just narrowed it down to say a dozen people. If most of the other sites are state and federal tax sites, banking sites etc. then its probably the CFO - an identifiable person.</p>
