IP Geolocation and Privacy: A Practical GDPR Checklist
IP addresses are personal data in the EU. Here is how to keep using geolocation lawfully without building a surveillance database.
# IP Geolocation and Privacy: A Practical GDPR Checklist
EU regulators treat an IP address as personal data when it can be linked to a person. Geolocation derived from it inherits that status. None of this makes geolocation unusable — it makes it something you have to be deliberate about.
Pick a lawful basis and write it down
For fraud prevention and network security, legitimate interest is the usual basis and is explicitly recognised in Recital 47. For personalisation, legitimate interest is defensible when the processing is coarse and the user can override it. Document the balancing test once; you will be asked for it.
Minimise the field, not just the retention
Ask what the coarsest field that solves the problem is. Usually it is country. If you only need country, do not store city or coordinates. This single decision removes most of the risk.
Retain decisions, not lookups
There is rarely a reason to keep a per-user log of resolved locations. Keep the outcome — rule fired, currency shown, challenge issued — with the inputs summarised. You keep your audit trail and lose the liability.
Guarda applies the same principle to itself: lookups are resolved live and results are not retained on our side. We count usage, not people.
Cover it in the notice
Your privacy notice should say that you derive approximate location from IP addresses, why, and for how long anything is kept. One clear paragraph is enough.
Handle the rights requests
If you can tie a location record to a user, you must be able to export and erase it. Storing decisions rather than raw records makes this trivial instead of a project.
Sub-processors and transfers
A geolocation vendor that receives your users' IP addresses is a processor. Check where it operates, list it in your records, and make sure the DPA is in place. A vendor that persists your lookups is a longer conversation than one that does not.
The checklist
- [ ] Lawful basis documented
- [ ] Coarsest sufficient field in use
- [ ] Decisions retained, raw lookups not
- [ ] Retention period defined and enforced
- [ ] Privacy notice updated
- [ ] Vendor listed with a DPA
Six lines, and geolocation stops being a compliance question.