Quick answer: IP anonymization tells Google Analytics to remove the last part of each visitor’s IP address (the last octet for IPv4) as soon as it is received, before anything is stored. It is off by default and you switch it on in your tracking code: anonymize_ip in gtag.js, anonymizeIp in analytics.js, or the anonymizeIp field in a Google Tag Manager tag or settings variable. The main side effect is slightly less precise location data, usually at city level. With GDPR applying from 25 May, it is a sensible default for most sites.
IP addresses can be personal data under European law, because they can sometimes be linked to an individual. Google Analytics uses IP addresses to work out a visitor’s approximate location, then shows that data in the Geo reports. It does not show raw IPs in reports, but it still receives them.
IP anonymization reduces how much of that information Google processes. It is a small change, quick to make, and one of the first steps most privacy reviews recommend. This guide explains what it does and how to set it up correctly.
What IP anonymization does
When a visitor loads a page with Google Analytics, their browser sends a hit to Google’s collection servers. That request includes the visitor’s IP address, as every web request does.
With anonymization enabled, the hit includes a flag (aip=1). Google’s servers then set the last octet of an IPv4 address to zero, or the last 80 bits of an IPv6 address, in memory before the address is written to disk or used for anything else. For example, 203.0.113.57 becomes 203.0.113.0.
Google says the full IP address is never written to disk when anonymization is enabled. Geolocation is then worked out from the truncated address.
Why it matters
- Privacy regulations. Under GDPR, IP addresses can be personal data. Reducing what you collect is part of the data minimisation principle. Some regulators, notably in Germany, have long expected IP anonymization as a condition for using Google Analytics.
- Your privacy policy. Stating that you anonymise IPs is a clear, specific commitment that shows you have thought about visitor data.
- Low cost. It takes minutes and has very little effect on the reports most businesses use.
It is not a complete compliance solution. Cookies, user IDs and other identifiers still need to be considered, along with consent where required. Our guide to GDPR and Google Analytics covers the wider set of changes.
How to enable it
There is no switch in the Google Analytics admin. You add it in your tracking code, so the method depends on how you have installed analytics.
gtag.js (global site tag)
If you use the newer global site tag, add the anonymize_ip parameter to your config command:
gtag('config', 'UA-XXXXXX-Y', { 'anonymize_ip': true });
This must be set on the config call for each property you track. If you have several config lines, add it to each one.
analytics.js
If your site uses the analytics.js snippet, set anonymizeIp after creating the tracker and before sending the pageview:
ga('create', 'UA-XXXXXX-Y', 'auto');
ga('set', 'anonymizeIp', true);
ga('send', 'pageview');
Setting it on the tracker means every hit that follows (pageviews, events, ecommerce) is anonymised. If you only want it on one hit, you can add it to that send call instead, but there is rarely a reason to do that.
Google Tag Manager
In Tag Manager, the cleanest approach is to set it once in a Google Analytics Settings variable:
- Open the Google Analytics Settings variable used by your Universal Analytics tags.
- Expand More Settings, then Fields to Set.
- Add a field with the name anonymizeIp and the value true.
- Save and publish the container.
If your tags do not use a settings variable, add the same field to each Universal Analytics tag under its advanced settings. Using a settings variable is better because new tags inherit it automatically. Our article on Google Analytics setup explains how to structure GTM tags this way.
WordPress plugins
Many WordPress analytics plugins include an option to anonymise IPs, such as a checkbox in the plugin settings. If your theme or a plugin adds the tracking code, check its settings first. If the tracking code is pasted into the theme header, edit it there or, better, move to Tag Manager.
Old ga.js code
If your site still uses the legacy ga.js snippet (_gaq.push), it is time to upgrade anyway. The equivalent command exists (_anonymizeIp), but ga.js is outdated and lacks many features. Our Universal Analytics upgrade guide covers the move.
How to check it is working
Do not assume it is on just because you added the code. Check:
- Open your site in Chrome and open Developer Tools.
- Go to the Network tab and filter by “collect”.
- Reload the page and click the request to google-analytics.com/collect (or /r/collect).
- Look at the query parameters. You should see aip=1.
The Google Tag Assistant extension is another quick way to inspect hits. If you use GTM, preview mode lets you check which fields are set on each tag before publishing.
Check a few page types, such as the homepage, a blog post and the checkout, because some sites load different tracking code on different templates.
What changes in your reports
For most sites, the effect is small:
- Location accuracy. Country and region data stay largely accurate. City-level data becomes less precise, and some visitors may be assigned to a nearby city or to “(not set)”.
- IP filters. Filters see the truncated address, so a filter that excludes one exact office IP may stop matching. Change it to match the address ending in .0 (bearing in mind that also excludes the other addresses in that block), or exclude internal traffic another way, such as a cookie or a custom dimension set for staff.
- Other reports. Traffic sources, behaviour, conversions and ecommerce data are not affected.
If your business relies heavily on city-level targeting, compare Geo reports for a few weeks before and after the change, and annotate the date in Google Analytics.
Common mistakes
- Adding it after the pageview. In analytics.js, setting anonymizeIp after the send command means the first pageview is not anonymised.
- Missing a property. Sites with multiple trackers or duplicate code often enable it on one and forget the other.
- Two tracking codes. A plugin and a hardcoded snippet can both be running. Check source code and remove duplicates.
- Forgetting other tools. IP anonymization in Google Analytics does nothing for heatmap tools, chat widgets, ad pixels or other scripts that also receive IP addresses.
Other privacy settings to review
While you are making changes, review:
- Data sharing settings in the Google Analytics account.
- Advertising features and remarketing, if you do not use them.
- Whether any URLs or events send personal data such as email addresses.
- The data processing terms in your account settings.
- How your cookie banner and consent setup control when analytics loads.
FAQ
Does IP anonymization make Google Analytics GDPR compliant?
On its own, no. It is one helpful step. Consent, your privacy policy, data processing terms and avoiding personal data in hits all matter too.
Can I enable IP anonymization in the Google Analytics admin?
No. It is set in the tracking code or in Google Tag Manager, not in the admin settings.
Will anonymizing IPs affect my internal traffic filter?
It can. Filters see the shortened address, so an exact-match filter on your office IP may need to change to the version ending in .0. Check the real-time reports from your office after the change.
Small change, clear benefit
IP anonymization is one of the simplest privacy improvements you can make to your analytics, and it barely affects the numbers you rely on. If you want a full review of your tracking and privacy settings before May, our analytics and reporting service can check it for you.
