My goal in using Google Analytics is to determine the external traffic on my website. The IP addresses of internal staff are filtered so they are not compiled in the data. The GA account is personally owned only by me and is password protected. However, don't ISPs who dynamically assign IP addresses defeat this filtering?

  • 2
    You appear to believe that Google knowing the IP addresses of the website staff is a security risk even though ISPs already know these addresses. – Erwan Legrand Oct 19 '17 at 7:36
  • In my opinion "security" without threat modeling is an empty word. If hiding the IP addresses actually makes sense in your case, then staff should use privacy enhancing technology to hide IP addresses. – Erwan Legrand Oct 19 '17 at 7:40
  • What risks are you concerned about? As you can see, we are all guessing at what your concern is – schroeder Oct 21 '17 at 18:50

You really should have a special flag on your program so that your internal staff's accounts never load the analytics script. Either that or always include a special flag in their reported analytics.

On the IP question: it depends. If you are only concerned about hiding the analytics from the work network you will usually get a static IP if you have business class internet. If not, your IP may not be changing that often anyways. You really don't want to be filtering by IP though.

There is no security risk beyond sensitive data being stolen from your analytics. If your IP changes and suddenly your hidden IP is now in use by one of your users there are still no security issues since you shouldn't be (and really can you even?) using GA for security logging.

| improve this answer | |

There is no security risk.

The reason why you wouldn't want IPs of your staff showing up is so that you do not dilute / pollute the data collected.

I'm struggling to see the connection to security here but if I understand correctly you are worried that staff with dynamic IP addresses can bypass your filtering and pollute your reporting data - i.e you won't be able to confidently say that all your traffic on a particular day was from a successful marketing campaign e.t.c.

Sadly there is nothing you can do with this dynamic IP setup besides either getting them to use IPv6 or keeping track of their public IPs to know when they change - obviously this is a lot of work!

There is no security implication unless you were using the IPs for some sort of firewall filtering such as cloudflare for example.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.