Iubenda logo
Start generating

Documentation

Table of Contents

How to Anonymize IP Addresses and Avoid the Cross-Referencing of Data in Google Analytics

⚠️ Important update

Say goodbye to manual IP anonymization. Google Analytics 4 now ensures IP addresses are not stored by default, enhancing your user privacy.

👉 Want to learn more? Check out our Google Analytics 4 overview.

If you’re using Google Analytics to track your user activity, and you have European users, to anonymize IP address is probably worth implementing.

Europe-based users have enhanced data privacy rights under the GDPR, and as IP addresses are considered personal data, you need to be mindful of how it’s processed.

In the sections below, we explain how to anonymize IP address in Google Analytics, and the reasons why you may need to.

To limit consequences related to the use of Google Analytics it’s often necessary to:

🔎 IP anonymization in Google Analytics

The IP anonymization feature in Google Analytics anonymizes the last digits of the user’s IP.

In Google’s words :

When a customer of Analytics requests IP address anonymization, Analytics anonymizes the address as soon as technically feasible at the earliest possible stage of the collection network. The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to the Analytics Collection Network. For example, an IP address of 12.214.31.144 would be changed to 12.214.31.0 (if the IP address is an IPv6 address, the last 80 of the 128 bits are set to zero). The full IP address is never written to disk in this case.

For more details on how anonymization works, read Google’s IP Anonymization in Analytics post in the Analytics help center.

Caution

Recent decisions by several European Data Protection Authorities have deemed the use of Google Analytics to be unlawful when handling the personal data of Europe-based users. To see which provisions are currently in place or follow the discussions about the use of Google Analytics in Europe, read this post.

Why anonymize IP addresses in Google Analytics?

Google has provided this function since May 2010 to allow website owners to request that all of their users’ IP addresses be anonymized within Google Analytics .

This feature is designed to help site owners comply with their own privacy policies, recommendations from local data protection authorities and legal regulations like the GDPR , which may prevent the storage of full IP address information.

Google Consent Mode

To help advertisers manage cookies for analytics and advertising purposes , Google has introduced Consent Mode, a feature that allows you to avoid prior blocking for Google Analytics and Google Ads (including Google Ads Conversion Tracking and Remarketing).

👉 Learn how to implement it with our Privacy Controls and Cookie Solution.

How to use the IP anonymization

To set up and use IP anonymization, you need to do two things:

  1. edit the Google Analytics code on your site / app ;
  2. update your privacy policy .

Code

Before diving into code implementations, here are a few points to note regarding Google Analytics libraries:

  • ga.js is a legacy library. Here’s how to migrate from ga.js to analytics.js .
  • the gtag.js library is the recommended tracking code for new implementations. However, there may be cases where you may still be using  analytics.js (eg, your site already makes use of analytics.js). In any case, here’s how to migrate from analytics.js to gtag.js .

That being said, below you’ll find implementation snippets for:

Important

The codes below are just examples and need to be adapted to your working site.

📌 IP anonymization with gtag.js

To anonymize IP addresses for all events, update the configfor your property by setting the value of the anonymize_ipparameter to true:

gtag('config', 'GA_TRACKING_ID', { 'anonymize_ip': true });

The full Google Analytics snippet therefore would look something like this:

<!-- IP anonymization with gtag.js - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=GA_TRACKING_ID"></script>
<script>
    window.dataLayer = window.dataLayer || [];
    function gtag() {
        dataLayer.push(arguments);
    }
    gtag('js', new Date());
    gtag('config', 'GA_TRACKING_ID', { 'anonymize_ip': true });
</script>

More info regarding the IP anonymization with gtag.js and the implementation snippets can be found on this Google Developers guide .

📌 IP anonymization with analytics.js

To anonymize the IP address for all hits sent from a single tracker, use the setcommand to set the anonymizeIpfield to trueon the tracker:

ga('set', 'anonymizeIp', true);

The full Google Analytics snippet therefore would look something like this:

<!-- IP anonymization with analytics.js - Google Analytics -->
<script>
    (function(i, s, o, g, r, a, m) {
        i['GoogleAnalyticsObject'] = r;
        i[r] = i[r] || function() {
            (i[r].q = i[r].q || []).push(arguments)
        }, i[r].l = 1 * new Date();
        a = s.createElement(o),
            m = s.getElementsByTagName(o)[0];
        a.async = 1;
        a.src = g;
        m.parentNode.insertBefore(a, m)
    })(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');

    ga('create', 'UA-XXXXX-Y', 'auto');
    ga('set', 'anonymizeIp', true);
    ga('send', 'pageview');
</script>

More info regarding the IP anonymization with analytics.js and the implementation snippets can be found on this Google Developers guide .

📌 IP anonymization for Google Analytics for iOS

Firebase SDK

The Firebase SDK is the recommended method to track iOS apps.

All IP addresses are unconditionally anonymized and stored by Firebase Analytics. There is no need (or method) to explicitly do so .

However, according to Google’s product manager Steve Ganem :

Nothing guarantees that we anonymize these in Firebase’s API design or terms of service . Given that it’s just an implementation detail, you should be careful if you are trying to rely on this for any sort of legal compliance or to meet your company’s privacy policies . The docs and APIs are updated frequently and you should keep an eye on them, as well as the release notes , for changes.

Note: This is one noteworthy example of why it’s important that your privacy policy include the relevant and up-to-date clauses specific to the particular service and the current guarantees of that service.

iOS SDK

If you choose to use Google Analytics Services SDK for iOS , here’s how to enable the AnonymizeIP functionality for a tracker:

[tracker set:kGAIAnonymizeIp value:@"1"];

The AnonymizeIP functionality can be set at any time.

More info on developers.google.com .

📌 IP anonymization for Google Analytics for Android

Similar to iOS apps, the Firebase SDK is the recommended method to track Android apps. All IP addresses are unconditionally anonymized and stored by Firebase Analytics, with the necessary precautions mentioned above .

Not withstanding the above, if you choose to use Google Analytics Services SDK for Android , use the following parameter in your configuration file to enable anonymize IP functionality:

<string name="ga_anonymizeIp">true</string>

To enable anonymize IP functionality programmatically for a tracker use the setAnonymizeIpmethod:

mTracker.setAnonymizeIp(true)

The setAnonymizeIpmethod can be called at any time.

More info on developers.google.com .


Avoiding the cross-referencing of data

This constraint has been required by the Italian Authority in order to ensure that Google Analytics cookies are not subject to extra legal requirements. It’s also useful when approaching GDPR specifications related to the monitoring or profiling of users ( see recital 24 ). In other words, it’s the procedure to prevent Google from “cross-referencing” information from Analytics with other data in its possession.

💡  To learn more about which EU cookie consent rules apply on a per-country basis, check out our Cookie Consent Cheatsheet here .

To comply with this requirement it is necessary to change the settings of your Google Analytics account in order to disable permissions related to ” Google products and services “, ” Benchmarking “, ” Technical assistance ” and ” Account expert “.

Here’s how:

  • Log in to your Google Analytics account
  • Click on Administration at the bottom of the left menu
  • If you manage multiple Analytics accounts, choose the desired account from the pull-down menu at the top left
  • Click on Account Settings
  • Remove the check mark from the sharing settings as shown in the image below: anonymize ip address
  • Click on Save

For more information, please read Data sharing settings on the official Google Analytics Help Center.


Adding the Corresponding Disclosures in Your Privacy Policy

Once you’ve changed the code on your site / app, it’s time to include this information in your Privacy Policy.

Our Privacy and Cookie Policy Generator makes it easy for you to meet your legal disclosure obligations by allowing you to correctly inform your users and define necessary details in a legally compliant way.

The process is straightforward and intuitive:

  • Add any service you may be using. You can choose the services that apply to you from among our 1700+ pre-created clauses. In this case, it will be ” Google Analytics with anonymized IP ” (or ” Google Analytics for Firebase ” if you use the Firebase SDK for iOS / Android)Google Analytics with anonymized IP
  • Fill out your web / app owner and contact details
  • Add the iubenda Privacy Policy to your site or app

Create your Privacy Policy for Google Analytics with anonymized IP

Start generating

See also