Geographic Analytics Without Storing IP Addresses

An IP address is personal data

Under GDPR an IP address is personal data, because it can identify an individual when combined with other information. Storing one puts you in scope for obligations most analytics deployments would rather avoid.

But country-level reporting is genuinely useful. The two are reconcilable.

Resolve at ingest, then discard

The ordering is the whole trick:

1. A request arrives carrying an IP.

2. Look it up in a local database — country, region, city.

3. Write those fields to the event row.

4. Let the IP fall out of scope. Never write it.

const geo = geoip.lookup(req.ip);
await insertEvent({
  siteId, path, timestamp,
  country: geo?.country ?? null,
  city: geo?.city ?? null,
  // no ip column exists
});

The strongest version of this is structural: there is no IP column in the schema. A field that does not exist cannot be populated by a future change that forgets why.

Local database, not an API

Use an embedded lookup database rather than a geolocation API. Two reasons.

Latency: a network call on the tracking path adds tens of milliseconds to every event.

Privacy: calling a third-party API sends your visitors' IPs to that third party, which reintroduces exactly the problem you were solving.

City-level precision and honesty

City-level GeoIP is roughly 50-80% accurate depending on country, and worse on mobile networks where the address often resolves to a carrier gateway hundreds of kilometres away.

Report country confidently. Treat city as indicative and say so in the interface. An analytics tool that presents an uncertain number as precise teaches people to distrust the ones that are accurate.

What you give up

You cannot do per-visitor IP investigation, block a specific address after the fact, or do fine-grained fraud analysis. Those are real losses for some use cases.

For web analytics they are almost never needed, and the trade buys a materially simpler compliance position: no IP retention policy, no IP in your backups, nothing to disclose in a subject access request.