# Cookie compliance under GDPR

**URL:** <https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275>\
**Category:** Community Building\
**Tags:** gdpr\
**Created:** [April 13, 2018, 7:10pm UTC](https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275 "2018-04-13T19:10:56Z")\
**Posts on this page:** 1\
**Showing post:** 14

<div class="post-metadata">

**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\
**Post date:** [April 17, 2018, 8:33pm UTC](https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275/14 "2018-04-17T20:33:12Z")

</div>

> [@ChrisBeach](#):
>
> No IP addresses stored in the Discourse DB - all should be hashed in an irreversible way

There is no point in hashing IP(v4) addresses – there’s not enough of them to prevent reversing the hashes through brute-force. The only way to anonymise IPv4 data is to not store it. Which makes a real mess of pretty much every anti-abuse measure in existence (not just in Discourse – when the only non-spoofable information is L3/L4, to decide whether or not something is abuse, what _else_ are you going to key off, other than source IP address?)

> [@allu](#):
>
> Geolocation would be important to at least enable GA for non-EU users by default.

How so? Do EU residents not travel outside the EU? Or does the GDPR not apply to EU residents when they’re not accessing the Internet via an IP address which is identified as being within the EU? That seems… unlikely.

---

_[View the full topic](https://meta.discourse.org/t/cookie-compliance-under-gdpr/85275)._