Mis on IP anonymization?

IP anonymization means making visitor IP addresses non-identifying before analytics data is stored: truncating the final octet (so 203.0.113.42 becomes 203.0.113.0), hashing with rotating keys, or discarding the address entirely once its momentary uses, like country lookup, are done. It exists because regulators treat IP addresses as personal data under the GDPR: combined with timestamps, an IP can identify a person.

The methods differ more than they sound. Truncation is one-way but coarse. Hashing with a fixed key is barely anonymization, since anyone with the key and the dictionary of possible IPs can reverse it; rotating short-lived keys is the defensible version. Google Analytics historically offered IP anonymization as an opt-in flag, and configuring such flags correctly is part of running cookie-based tools lawfully. Privacy-first tools invert the default: the IP is used transiently to derive a session token and a country, then never written to disk, which is the approach Analyse takes as described in the cookieless analytics guide.

Anonymizing IPs does not by itself make a tool consent-free; stored device identifiers still trigger the consent requirement independently.