Analyzing logs without holding raw IPs

Analyzing logs without holding raw IPs

IPs are personal data under GDPR. These cover analysis that stays compliant.

→ Nginx and Apache IP-masking configs — zero the last octet at write time.
Takeaway: $remote_addr can be truncated before it ever hits disk.

⭐ Pick of the week: Matomo's IP-anonymization docs — the cleanest explanation of why /24 masking still allows geo + bot analysis.
Takeaway: you rarely need the full IP for SEO work.

→ The EDPB guidance on IP addresses as personal data — the legal grounding, plainly stated.

→ Apache's mod_remoteip notes — keep the verification path (full IP) only in memory for the DNS check, then drop it.

Credit to Matomo, the EDPB, and the Apache/Nginx docs.