Are your IP addresses anonymized?

Table of Contents

For some privacy laws, anonymized statistics, and a specific configuration of your analytics provider, e.g., Google Analytics, allow setting statistics cookies before consent. 

How to configure your Google Analytics account for GDPR and other privacy laws can be found here. Anonymizing your IP addresses for Analytics with Tag Manager is easy. Even easier, is letting Complianz anonymize IP addresses, but how do you know they are anonymized?

How anonymizing IP addresses works

A user visits a website with an IP address, which might look like:

12.214.31.144 or if IPV6 is allowed:
2001:0620:0000:0000:0211:24FF:FE80:C12C

Before Google Analytics collects the IP addresses and writes to your Google Dashboard it will go through a script which can look like this:

gtag('config', 'GA_TRACKING_ID', { 'anonymize_ip': true });

ga('set', 'anonymizeIp', true);

This function will strip a significant part of your IP address so, in the eye of privacy laws, changes from personal data, to non-identifiable data.

For example, it does so by changing:

12.214.31.144 or if IPV6 is allowed:
2001:0620:0000:0000:0211:24FF:FE80:C12C

To:

12.214.31.0 or if IPV6 is allowed:
2001:0620::::::FE80

However, you can’t check if these IP addresses are anonymized correctly in real-time. That’s why Google added a parameter in the URL they use to collect information and write to your Google Analytics dashboard, which you identified with a UA-Code.

Confirm your anonymizing IP Addresses

There are multiple implementations of Google Analytics. We will summarize the 3 most common implementations:

  1. Google Analytics – UA-* Tracking Code (gtag.js)
  2. Google Analytics 4 – G-* Tracking Code (gtag.js)
  3. Google Analytics Consent Mode

1. Google Analytics – UA-* Tracking Code – Gtag.js

You can recognize this implementation by the tracking code used and the javascript attributes of the snippet provided by Google;

				
					console.log( 'Code is Poetry' );
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-46798500-2', {
	cookie_flags:'secure;samesite=none',
	'anonymize_ip': true
});
				
			

To see if anonymizing works as intended you can use the below video or manually search for the parameter in the request header, it should be aip=1

  1. In your browser console, go to “Network” and filter on “Analytics”
  2. Find the “collect?” parameter for the UA tracking code (these days a Google Analytics 4 might be automatically connected).
  3. Search for the AIP request or, which always works find the parameter in the request URL:
				
					Request URL: https://www.google-analytics.com/j/collect

// Parameter
?v=1&_v=j96&aip=1 // Anonymous IP = 1

// Parameter
&a=1997624889&t=pageview&_s=1&dl=https%3A%2F%2Fdesigncmplz.us.instawp
.xyz%2F&ul=nl&de=UTF-8&
=designcmplz%20%E2%80%93%20Just%20another%20WordPress%20site&sd
=24-bit&sr=375x768&vp=375x768&je=0&_u=QACAAUABAAAAAC~&jid=851651791
&gjid=1416771107&cid=1183590676.1646661841&tid=UA-46798500-2&_
gid=2098021356.1646661841&_r=1&gtm=2ou320&z=1200395627
				
			
To see if anonymizing works as intended you can use the below video or manually search for the parameter in the request header, it should be aip=1
  1. In your browser console, go to “Network” and filter on “Analytics”
  2. Find the “collect?” parameter for the UA tracking code (these days a Google Analytics 4 might be automatically connected).
  3. Search for the AIP request or, which always works find the parameter in the request URL:

2. Google Analytics 4 – G-* Tracking Code – gtag.js

Google Analytics for implementations will look similar to the below. You will notice that anonymize_ip=true is no longer added, as anonymization is the default proposition of GA4. This means the request URL does not contain the parameter aip=1. In this case, a G-tracking code, compared to other tracking codes is anonymized by default.

				
					window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-4679KLM8500', {
	cookie_flags:'secure;samesite=none'
});
				
			

3. Google Analytics Consent Mode – gtag.js

If you’re using Consent Mode, you should look for parameters that contain and refer to the following:

Category Storage Parameter Cookies Analytics Dashboard
Functional Denied gcs=100 No Paramater Request / Unknown
Statistics Granted gcs=101 Depends on configuration Yes
Marketing Granted gcs=110 Yes Yes
Combination Granted for All gcs=111 Yes Yes

Join 1M+ users and install The Privacy Suite for WordPress locally, automated or fully customized, and access our awesome support if you need any help!

Complianz has received its Google CMP Certification to conform to requirements for publishers using Google advertising products.