Two phrases get used as if they were the same product: IP anonymization and cookieless analytics. They are not.
IP anonymization, in the Google Analytics sense, meant: still set a client id cookie; still send hits to Google; mask part of the IP in the hit. Cookieless analytics, in the SiteLine sense, means: do not set an analytics cookie; derive a visitor id on the server from a truncated IP, user agent, and daily salt; do not persist the raw IP on the event.
You can anonymise IPs and still need a cookie banner. You can be cookieless and still process personal data. You can do both and still send payloads to a US-linked vendor. SiteLine does the cookieless design and is honest about the rest. Policy: /privacy. Implementation: /docs/privacy. Not legal advice.
What Google’s “anonymize IP” actually did
Universal Analytics offered anonymizeIp. It zeroed the last octet of IPv4 (a /24 mask) before storage in some Google systems. GA4’s public story is that IP is not logged or stored. In both worlds, the cookie was the long-lived identifier, not the IP. Masking the IP did not remove _ga. EU regulators who objected to GA4 were not primarily writing dissertations about the 4th octet; they were writing about cookies, unique identifiers, and transfers of Google Analytics data to the United States after Schrems II.
If your privacy policy still says “we anonymise IP addresses in Google Analytics” as the reason you skip a banner, the policy is describing the wrong control.
What SiteLine does with the IP
Order of operations:
- The collect POST arrives (directly or via your proxy).
- The IP is truncated: IPv4 → /24, IPv6 → /48.
- Truncated IP + user agent + daily rotating salt → SHA-256 visitor id.
- The event row does not store the raw IP.
The truncation is coarser than “last octet only” for IPv6 (/48, not /128). The daily salt means the identifier is not a stable pseudonym you can join across months. The missing raw IP means a dashboard export is not a ready-made access-log replay.
None of this happens in the browser as a substitute for sending an address. TCP still has a source IP. Aglet Technologies sees it at ingest long enough to truncate and hash. App request logs for siteline.tools logins are a separate stream (security, CSRF, session) — do not confuse those with analytics events.
Hostname allowlisting and bot filters run on the same ingest path so a public site id and crawler traffic do not pollute the hash space or the quota.
Why people still conflate the two
Because both are “something about IP” sold next to GDPR. The useful test is:
| Control | Typical GA IP anonymization | SiteLine cookieless |
|---|---|---|
| Analytics cookie | Yes (_ga) |
No |
| Device storage | Yes | No |
| Visitor id lifetime | Months | Until UTC midnight |
| Raw IP on the hit | Masked / not stored (vendor-claimed) | Not stored on the event |
| Request destination | SiteLine (Aglet Technologies) | |
| Banner trigger (ePrivacy) | Usually yes | Not for this cookie |
Cookieless is the banner-relevant change. IP truncation is a minimisation step inside the hash. Together they are cookieless tracking. Apart, IP masking is a footnote.
What neither control fixes
Transfers. After Schrems II, where the processor sits matters. SiteLine is not marketed as EU-only hosting. Stripe and Cloudflare process some data in multiple countries. See EU analytics after Schrems.
Other cookies. IP hashing does not uninstall Meta Pixel.
Identified properties. If you send user_email as a custom property, you have identified analytics with extra steps.
Ad blockers. Blocklists do not care that you truncated an octet. First-party proxy (customer nginx/Caddy/Cloudflare/Vercel; no managed CNAME in v1) is the practical mitigation.
Australian APP notice. Truncation is not “not personal information.” Analytics and the Australian Privacy Act.
Retention still applies: analytics while you subscribe ($4.99 / $19.99 / $99.99 USD, 7-day trial) plus 30 days’ grace; GSC while the account exists. siteline.tools app cookies remain session, CSRF, theme/sidebar. Contact [email protected].
FAQ
If the raw IP is not stored, is ingest using the IP at all?
Yes. Truncation and hashing need the address at processing time. “Not stored on the event” is not “never observed on the wire.”
Is /24 + daily salt anonymous under GDPR Recital 26?
We do not claim that. It is a deliberate reduction of identifiability and lifetime. Your DPA or counsel may still call it personal data. We write the mechanics so they can argue from facts.
Can we combine GA4 IP anonymization with SiteLine?
You can run both; you would still have GA4 cookies unless you stop GA4. Combining two IP-masking stories does not make a cookie disappear. If the goal is consent-free analytics for cookies, replace the cookie-setter.