How will IPs help you? Nobody is running those bots using datacenter IPs.

How can you anonymise an IP address? Given that (as I understand it) an IP address is considered personally identifying information under GDPR.

Google Analytics can do this by setting the last octet of IPv4 addresses and the last 80 bits of IPv6 addresses to zeros.

Reference: https://support.google.com/analytics/answer/2763052?hl=en

I thought this wasn’t true unless you had other data to aid in linking the IP address directly to the person (in http://curia.europa.eu/juris/document/document.jsf?text=&doc...).

So unless you have additional identifiers, an IP address by itself isn’t enough.

That’s not how I interpreted the ruling from the case you linked, although I’m not a lawyer:

Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

Additionally, from a cursory read, it appears like they are only talking about dynamic IP addresses anyway, but you, as a service operator, have no way of knowing if an IP is dynamic or static.

This is the key: ...where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person

Imagine you walk into a grocery store and pick up a rewards card to save N%. To get it, you have to give a phone number. If you write down your phone number, you've handed over some PII. If you write down a fake number, it's still legally PII, but has been anonymized, so the store won't be able to find you.

The original comments was about detecting if a given IP is a bot or not - I assume they probably can't do that given 32 random bits!

You can simply truncate the IP address and remove the last block (byte).

Just curious if you can contact me or, better, put contact information in your profile.