Privacy finding
The site says IP addresses are anonymised and nobody has confirmed the vendor setting
Privacy Warning Severity: Medium
Part of the audit Privacy claims on the page that the page itself disproves. Finding id: privacy.anonymisedIpClaim.
What it costs you
The claim depends on a setting at the vendor. If the tool was replaced or the setting changed, the claim is no longer true and nothing on the site shows it.
What to do
Look up how [vendor] treats IP addresses in your account and record the result.
What it checks
- Anonymized IP claim but full IP sent
How to fix it
Switch the setting on or reword the claim
- Switch on IP shortening at [vendor] if the tool offers it.
- If it does not, reword the claim to what the tool does.
How to check: Record the new state of the setting. This finding closes when the stored verdict is 'ok'.
Confirm the setting at the vendor
- Open the account at [vendor] and find how IP addresses are handled, or read the vendor's documentation on it.
- Record what you found: confirmed or not.
How to check: This finding closes when the stored verdict is 'ok'.
A real case
In a 2022 decision on a website's use of Google Analytics, the Austrian data protection authority called Google's IP anonymisation a useless protection measure, because the shortening happens only after the data have reached Google. It found the transfers to Google unlawful.
How to verify by hand
The vendor's settings or its documentation on IP addresses.
What this relies on
The claim was true for the tool in use when it was written.