2

Because of French law (CNIL), I have to protect the customer from being traced by their IP. So, where are stored the customer's IP and how to anonymize them (replacing the last 2 Bytes by 0) ?

  • sales_flat_order.remote_ip
  • poll_vote.ip_address
  • any other location linkin a customer to his IP

I could do it in a sql script run in cronjob, but the IP addess must never be fully written in the first place.

Did anyone worked on this so far? not looking for code, but for advices.

Maybe an obscure Magento parameter magically totally disable the IP storing? Or should I make a custom module?

Addendum: I know that implies to work with third party (Systempay, paypal, analytics), but I would like to not spread this topic in too many directions)

Thanks by advance.

2 Answers 2

1

On top of what you said I'm pretty sure the rating vote table stores the IP as well.

Also, I think PayPal does store the IP from the data sent from Magento.

Another 3rd party library you have to deal with is Google Analytics which is available OOB with Magento but Google provides a good documentation for that: https://support.google.com/analytics/answer/2763052?hl=fr

Possible module development

To me your best bet is to list where the IP are stored first.

Second, you need to create event observers on the beforeSave method of all of those database entries. And in your observer you need to rewrite the IP on the fly so you need have the full IP addresses stored in your database.

I'm not aware of any Magento parameter to enable IP anonymisation.

Alternative

Another thing you can do is to rewrite the getRemoteAddr method from Mage_Core_Helper_Http as this method is widely used in Magento to retrieve the remote IPs. Thus by modifying this method, you can strip the result to avoid getting the real IP address. However, I'm pretty sure that will impact badly other features from Magento that don't store the IP but still deal with them (for example, the allowed IPs feature).

2
  • Thanks for the advices, I think I will work on the module, as the alternative covers only a part of the problem: by requesting directly the database, one could trace back a customer to his IP(s) Sep 5, 2016 at 15:55
  • @nicolallias to me that's definitely your best bet. Sep 5, 2016 at 15:59
2

I know this topic is old but if anyone faces the same problem (and I think because of the GDPR many should), it helped for us to anonymize the IPs on the server

mod_removeip on apache

Then magento don't save the customer ip anymore in the orders (remote_ip), visitors and so on.

Hope it helps

1
  • Indeed, that is most certainly in the trends :) May 22, 2018 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.