The impact of last-digit IP anonymization

Because of data protection regulations, most browsers (such as Safari and Firefox) currently block 3rd party cookies by default. And it’s also why Google Chrome plans to eliminate cookies by 2023.

Just like 3rd party cookies, however, IPs can also be considered personal identifiers. That’s why many organizations choose to apply IP data in privacy-protected ways. For instance, some IPinfo users use last digit IP anonymization as one of their data protection methods.

Personal identifiers means information relating to an individual that contains direct or indirect identifiers to which a reasonable basis exists to believe that the information can be used to identify an individual. LawInsider.com

And since several organizations use this method in their arsenal of privacy policies, our team at IPinfo started researching the effect of hashing out the last digits of IP addresses.

Here’s what we discovered.

The impact of anonymizing IP addresses

For those who aren’t familiar with this strategy, here’s a bit of background.

Normally, an IP shows up something like this: 90.183.96.190. But when you use last-digit anonymization, the last numbers will be rounded to the nearest value. In this case, the IP would resolve to 90.183.96.0.

While this is a pretty straightforward method to protect individuals’ data, it also raises a few questions:

• How does this method affect the accuracy of IP data?
• How does this strategy affect reliability of use cases?

These are the questions that IPinfo’s data team researched over the last few months.

How does last digit IP anonymization affect accuracy?

Geolocation data

When using last-digit anonymization, the coded location for IPinfo users stayed the same for about 90 percent of cases (and 99.6 percent had the same country code).

However, we noticed that location variation from zeroing out the last octet produces a median difference of 227 kilometers (or around 141 miles). We also discovered that the users who are most negatively affected are those who have many requests (bubble size), who have many ranges that stay the same, but who also query mostly the small % that will change. For the implications of these metrics, keep reading.

Company data

Based on the analysis we conducted on IPs that were 16 bits and smaller, we deduced that Company data will retain around 86 percent accuracy when rounding to 24 bits

And while we noticed some variance among tokens, the median accuracy was 86 percent. Additionally, 3 percent of users will experience no change in accuracy whatsoever. Essentially, the results are very similar to the geolocation percentage of accuracy.

In both cases, even though just about all users will notice some change, only a small number of IPinfo customers will notice a large coarsening of the data.

Carrier data

Most of our mobile carrier data doesn’t require the last octet to return information on the mobile IP’s carrier name, country code, and network code. In other words, this dataset automatically zeros out the last octet in most cases.

We have a few exceptions to this, but in general, most of our mobile carrier data only uses 24 bits of an IP address. All this to say, if users hash out the last octet, it shouldn’t affect the accuracy of the results.

VPNs

Similar to Carrier data, VPN data normally rounds to a range (such as WHOIS). Unless we’ve gathered specific corrective details about a specific IP from, say, a geofeed, this dataset operates with 24 bit IPs. Zeroing out the last digits on the user end will rarely affect accuracy.

Suffice it to say, Adtech can use last-digit IP anonymization to further protect the privacy of their users from third-party sources while still gathering enough data to protect PPC campaigns from fraudulent users and more.

Downloadable database

Hashing out IPs does affect accuracy and highly pinpointed use cases. However, all of these downsides can be avoided by simply using the downloadable database.

For instance, if users download IPinfo’s datasets, they won’t need to anonymize IPs at all. Additionally, users can then convert an IP to an IP range and then derive Company data, Geolocation insights, Mobile Carrier information, and more.

Since IPinfo’s insights operate using IP ranges, companies can avoid recording any specific IPs while gathering enough information to ensure reliable use cases.

Another benefit of the downloadable database is that users don’t need to submit any IP information to a third-party data provider, such as IPinfo. Plus, the database is updated every 24 hours and is monitored by our data experts and proprietary algorithms.

In other words, by choosing the downloadable database, customers won’t experience any change in accuracy and can avoid IPs as personal identifiers.

How does this strategy affect reliability of use cases?

With these metrics in mind, here’s what our data team concluded. Hashing out the last digits of IPs can still work for some non-specific use cases - that is, use cases that only need broad geographic information.

But users who need a high degree of data accuracy for reliable use cases (think online targeting or website security) can use the downloadable database without experiencing a coarsening of the data.

Use cases based on large geographic regions

Hashing out the last digit of an IP does affect accuracy. That being said, anonymized IPs can be used to target broad geographic areas such as countries.

City-level pinpointing, however, won’t be reliable. This limits use cases such as geotargeting or content restrictions. In other words, as we’ve helped customers build out use cases, we’ve noticed that most users require a high level of accuracy that last digit anonymization hinders.

For highly pinpointed use cases, users will maintain the best accuracy by using IPinfo’s Database Download. That being said, if you have questions, our data team can offer the best recommendations based on your specific use of IP data.

Strategies that don’t work with last digit IP anonymization

It’s also important to note that some targeting strategies will not work with hashed IPs. This includes IP to email matching. When an IP is anonymized, it’s automatically matched to a block of IPs.

For example, each of these addresses belong to one block - 8.8.8.0/24, and are matched to different emails:

• IP: 8.8.8.8 –> email: test@it.com
• IP: 8.8.8.7 –> email: hello@from-the-other-side.com
• IP: 8.8.8.6 -> email: ipinfo@works.well

There could be one or more email records connected to every IP address. But when the last digit is hashed out to zero, the block might contain so many email addresses that it isn’t possible to do any targeted actions. As in, email stops being matched to an individual identifier. Additionally, GPS-derived device location is nearly impossible when the last digits are hashed out.

All this to say, IPinfo regularly helps organizations and other users develop the right use cases to stay ahead of unique challenges within each industry. We’d love to help you use your IP data better!

Interested in learning more tips for data protection? Talk with one of our experts today!