# Problematic IP address fields
**URL:** https://meta.discourse.org/t/problematic-ip-address-fields/83785
**Category:** Feature
**Tags:** gdpr, privacy
**Created:** [March 25, 2018, 7:06am UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785 "2018-03-25T07:06:34Z")
**Posts on this page:** 12
**Page:** 2
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [April 21, 2018, 8:26am UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/22 "2018-04-21T08:26:17Z")
The GDPR is something I take very seriously.
However, my forums do not have legal teams to pick through this new and poorly-defined law.
The fines are huge, and there are always axe-grinding members looking to cause trouble for a forum. For me to keep running forums, I need to know the software I’m using is compliant with the new law.
If I interpret the law correctly then we need to ensure the following:
- If IPs have been stored for users without their consent, they absolutely need to be scrubbed from our database and no longer stored for anonymous visitors.
- When a signed up (or signing up) user visits the forum they need to see a consent screen with an unticked box and an explanation of how the IP will be used
- If consent is not given, they cannot be allowed to use the forum.
For the record, I absolutely deplore laws like this as do a poor job of protecting our rights yet they harm millions of businesses and scare the hell out of well-meaning and ethical operators.
I’m absolutely relying on the Discourse team here to take some action to protect its forum operators.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [April 21, 2018, 8:58am UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/23 "2018-04-21T08:58:23Z")
> [@ChrisBeach](#):
>
> If IPs have been stored for users without their consent, they absolutely need to be scrubbed from our database and no longer stored for anonymous visitors.
They can be stored, but no longer than necessary for a legitimate purpose.
For rate limiting, there is a legitimate interest and this period is pretty short.
For deduplicating link clicks, there is a legitimate interest but they need only to be stored in Redis for 24 hours. [I don’t see any reason](https://github.com/discourse/discourse/blob/master/app/models/topic_link_click.rb#L107-L112) at all to keep them in the database.
I don’t see the purpose or a legitimate interest for keeping IP addresses in search logs or incoming links.
In contrast to the opening post I do think the topic\_views and user\_profile\_views are problematic. After all, Redis is [already deduplicating IP addresses](https://github.com/discourse/discourse/blob/master/app/models/topic_view_item.rb#L19-L49) so there is no need to store the IP address longer than ` topic view duration hours`.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [April 21, 2018, 9:01am UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/24 "2018-04-21T09:01:09Z")
> [@RGJ](#):
>
> They can be stored, but no longer than necessary for a legitimate purpose.
Thanks for the info. Out of interest, where are legitimate purposes and storage limits defined in the lawbooks?
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [April 21, 2018, 9:09am UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/25 "2018-04-21T09:09:19Z")
Lawful purposes and legitimate interests are in [article 6 of GDPR](https://gdpr-info.eu/art-6-gdpr/).
[Recital 49](https://gdpr-info.eu/recitals/no-49/) talks about usage of data for network and information security.
[Recital 47](https://gdpr-info.eu/recitals/no-47/) mentions fraud prevention and direct marketing as a legitimate interest. Deduplicating link clicks and topic views could be considered fraud prevention.
There are no hard storage limits defined. The time you need to keep an IP address in order to deduplicate statistics depends on the granularity of the accumulated statistics.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [May 14, 2018, 10:38pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/26 "2018-05-14T22:38:29Z")
Sent in the first PR for cleaning this up: [IncomingLink: do not store IP of logged-in users by riking · Pull Request #5826 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/5826)
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [May 21, 2018, 7:09pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/27 "2018-05-21T19:09:17Z")
Just sent in 3 more PRs:
[https://github.com/discourse/discourse/pull/5850](https://github.com/discourse/discourse/pull/5850)
[https://github.com/discourse/discourse/pull/5851](https://github.com/discourse/discourse/pull/5851)
[https://github.com/discourse/discourse/pull/5852](https://github.com/discourse/discourse/pull/5852)
[https://github.com/discourse/discourse/pull/5853](https://github.com/discourse/discourse/pull/5853)
aaaand the linkback bot is going crazy with the edits to the OP, oops…
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 21, 2018, 7:11pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/28 "2018-05-21T19:11:50Z")
Very good, @sam can review these and make the call on 2.0 versus 2.1 depending on risk.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [May 21, 2018, 9:19pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/29 "2018-05-21T21:19:22Z")
Although I do absolutely welcome these PR’s I do want to emphasize that storing the IP addresses of visitors **without** an account (for a longer time than needed for deduplication) is a much more problematic issue since those people cannot easily be asked to give their consent.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [May 22, 2018, 7:14pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/30 "2018-05-22T19:14:19Z")
Yeah, I was starting to work on that and it’s a bit tricky due to all the various ways that topic view data is used for logged-in users! And topic views are interesting in that only the first time a user or IP sees a topic is counted right now - it doesn’t reset daily like some of the other data.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [May 24, 2018, 5:05pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/31 "2018-05-24T17:05:43Z")
One thing I should mention since it can help with GDPR stuff is when [IPs are anonymized](https://github.com/discourse/discourse/blob/master/app/services/user_anonymizer.rb#L92-L111) all of the problematic IPs identified in the OP are replaced.
This behavior is only available via plugins right now, but it does work.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 24, 2018, 11:08pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/32 "2018-05-24T23:08:13Z")
12 posts were merged into an existing topic: [GDPR countdown and compliance](https://meta.discourse.org/t/gdpr-countdown-and-compliance/87190/62)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 24, 2018, 11:10pm UTC](https://meta.discourse.org/t/problematic-ip-address-fields/83785/33 "2018-05-24T23:10:12Z")
@riking once we get ALL of these sorted we can start looking at “data hoarding” reduction.
So, for example we can roll up incoming links daily throwing away IPs and only including anon vs logged in counts per day (and follow a similar pattern for search)
But first let’s sort out all these PRs.
[Previous page](https://meta.discourse.org/t/problematic-ip-address-fields/83785.md?page=1)