Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am developing a PHP analytics program. I am using IP addresses to get its corresponding country. I was wondering if its OK to store both the IP address and Country or if its better if I just store the country in a MySQL database?

share|improve this question
up vote 6 down vote accepted

There should be no problems with this from a legal/personal information perspective, as if you are using IP ranges in aggregate to understand stats per country you are not storing information about an individual.

Your problem may be that you rely on the IP data to give you results - remember the IP address you see a connection coming from may have nothing to do with the individual connecting. They may be routed through intermediaries, or their ISP may be routing connections strangely, or their company may route internally to a point of presence in another company etc.

share|improve this answer

Why not just do this by prefix and ASN?

share|improve this answer
What is ASN? – Andrei Botalov Jul 21 '12 at 11:05
@AndreyBotalov This one: ASN. – Hendrik Brummermann Jul 21 '12 at 12:45
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. – Ulkoma Feb 15 '15 at 17:28

There is nothing wrong with storing the IP address of a visitor. There are any number of valid reasons to store IP addresses of visitors to your website (security, analytics, etc).

share|improve this answer
Nothing, except the privacy law in many European countries. – Hendrik Brummermann Jul 21 '12 at 12:46
So stats and analytics programs like AWStats are illegal in Europe? – DKNUCKLES Jul 21 '12 at 14:08
it is not that easy: Privacy law varies across countries and even across states within one country in Europe. Aggregated statistics are usually okay. So writing anonimized logfiles and applying those tools on them, is okay. – Hendrik Brummermann Jul 21 '12 at 14:56
@DKNUCKLES: They are not illegal, but they must provide a means for opting out. Or in some cases, opt-in by the user is required. – Simon Steinberger Jul 12 '15 at 20:52

In analytics there is ip address and user agent most often. And if you break everything into this unique combination, you will have plenty of data to group by, therefore this is best recommended to keep e.g. in separate table and extract from it only number of unique viewers and once a time (e.g. per month) delete them all.

I have e.g. hundreds of millions of such combinations, and just to keep it for e.g. a year it doesn't make sense.

I rather generate random key for each user and track him based on that, and not his ip number is completely unnecessary except for the security reasons but this is all mostly in the archive.

It is mainly because users will generate unlimited number of such combinations so best is just to not keep this data in online database, period :-)

Obviously derived data like location, ASN etc is a different story, this data is not unique to every user, so it's much lower amount of data to process.

share|improve this answer

It all depends on what the information you need to refer in future. Obviously, there's nothing wrong to store both the IP and country information, as the IP block changes from time to time, and the IP-to-Country correlation may not be the same in future.

share|improve this answer
I am collecting the IP address and the location of the IP address at the same time using an updated database. – ub3rst4r Aug 10 '12 at 0:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.