IP Anonymization in Google Analytics for GDPR Compliance

Google Analytics is all about tracking and analyzing individual visitor activities on a website. So you’d definitely want to use this tool for your site. Before that, you would want to know what type of data or user information Google Analytics collects. And you’d have concerns about whether it allows you to comply with the GDPR requirements. Indeed, there is nothing to worry about!

That great feature of Google Analytics, what you call IP Anonymization, enables you to anonymize/mask your visitor IPs before sending the hits to Google Analytics. This IP anonymization function has become operational since 25 May 2010, and it helps you remain GDPR-compliant.

Why anonymize IP addresses?

According to the GDPR, IP addresses are considered as PII (Personally Identifiable Information). So if you use a Google Analytics account, you’d require to prevent the storage of your website users’ IP address information. You could implement this through the IP anonymization function in Google Analytics.

Anonymizing your website visitor IPs can be considered as one of the key measures towards achieving GDPR-compliance. In fact, the significance of IP anonymization has increased since the European Union’s General Data Protection Regulation (GDPR) became enforceable.

How to anonymize your website user IPs in Google Analytics?

If you already have a Google Analytics account, you might probably know that the IP anonymization feature is disabled by default. So in order to anonymize your website users’ IP addresses, you’d need to make minor changes in the Google Analytics tracking code or add a new variable in your Google Tag Manager (GTM).

Now let’s get to know how to anonymize the IP addresses of your website visitors.

1. Anonymize IP addresses using analytics.js

If you use the analytics.js library, insert the following line of code in your Google Analytics tracking code to anonymize user IPs.
ga('set', 'anonymizeIp', true);

And therefore the modified Google Analytics tracking code would look like;
<!– Google Analytics ->
<script>
window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;
ga('create', 'UA-XXXXXXXXX-Y', 'auto');
ga('set', 'anonymizeIp', true);
ga('send', 'pageview');
</script>
<script async src='//www.google-analytics.com/analytics.js'></script >
<!– End Google Analytics –>

Note:
In place of UA-XXXXXXXXX-Y, use your own Tracking ID (Property ID).

2. Anonymize IP addresses using gtag.js

If you use the gtag.js library, insert the following line of code in your Google Analytics tracking code to anonymize user IPs.
{'anonymize_ip': true}

And therefore the modified Google Analytics tracking code would look like;
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-XXXXXXXXX-Y">
</script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-XXXXXXXXX-Y', {'anonymize_ip': true});
</script>

Note:
In place of UA-XXXXXXXXX-Y, use your own Tracking ID (Property ID).

3. Anonymize IP addresses with Google Tag Manager (GTM)

Follow the steps below to anonymize your website users’ IP addresses using Google Tag Manager.

    Step 1: Sign in to your Google Tag Manager account.

    Note:
    Click here to find how to install Google Analytics with GTM.

    Step 2: Open the tag used to configure Google Analytics on your website.
    GTM-tag Step 3: Open Tag configuration.
    Google Analytics - Universal Analytics Step 4: Expand More Settings.
    GTM Tag Configuration Step 5: Select Fields to Set option.
    GTM Tag Configuration - More Settings Step 6: Click +Add Field.
    GTM Tag Configuration - Fields to Set Step 7: Set the Field Name as anonymizeip.
    Anonymize IP Step 8: Set the Value to true.
    GTM - Add Field Step 9: Click Save.
    GTM - Anonymize IP - Save Step 10: Now, click Submit.
    GTM - Anonymize IP - Submit Step 11: Enter a Version Name and click Publish.
    GTM - Anonymize IP - Publish
Okay! Now, it’s finally time to test the implementation of your IP-address anonymization.

Validate the implementation of Google Analytics IP anonymization

If you want to test whether you’ve implemented IP anonymization in Google Analytics effectively, simply follow the steps below.

    Step 1: Head on to your website for which you have enforced the IP-address anonymization.

    Step 2: Open the Google Developer Console window.

    Note:
    To open the developer console, you could use the following keyboard shortcuts accordingly.

    On Macs:
    Press Command+Option+J

    On Windows, Linux, and Chrome OS:
    Press Control+Shift+J

    Step 3: Click on the Networks tab and reload your web page.

    Step 4: Enter collect in the search text box.

    Step 5: Click on the listing which includes www.google-analytics.com.

    Step 6: Check whether you can find the IP anonymization parameter (aip=1).

Once you have found the IP anonymization parameter, you can seamlessly ensure you have implemented the Google Analytics IP anonymization successfully.

After enabling IP Anonymization in Google Analytics: What happens?

When you turn on the Google Analytics feature (anonymizeIP/aip), the last octet of IPv4 addresses and the last 80 bits of the 128 bits of IPv6 addresses are set to zero right after the Analytics Collection Network obtains the users’ IP data. Simply put; the last 3 digits of your users’ IP addresses will be discarded automatically.

For example: The IP address of 69.89.39. 226 would be converted to 69.89.39.0.

Final thoughts

With Google Analytics, you are gathering the IP address of your website visitors. By anonymizing their IP addresses, you’d be able to rule out the illegal collection of the users’ IP-address data. And keep in mind that using Google Analytics without the extension anonymizeIP would end up putting yourself at the serious risk of GDPR violations.


Disclaimer: This article is intended to be used for informational purposes only and does not constitute any form of legal advice. You shall seek a subject matter expert or your own attorney for any legal advice based on the IP Anonymization in Google Analytics.