First of all, it is important to keep enough bits from the start of the address that it will still be clear which class of address it is. How many bits are needed in order to know that does however depend on which class of address it is.
Here are a few examples:
2001:0:xxxx:xxxx:: a Teredo address - 32 bits (two groups of digits) is enough to know it is a Teredo address.
2002:xxxx:xxxx:: a 6to4 address - 16 bits (one group of digits) is enough to know it is a 6to4 address.
2a01:xxxx:xxxx:: a globally routable address 3 bits is enough to know it is globally routable, but publishing the full first group is usually better in order to avoid confusion. If you showed two groups (32 bits), it would be enough to know country and provider, with only 16 bits available it would still be clear which continent the address belongs in.
fdxx:xxxx:xxxx:: a ULA address. 8 bits is enough to know that it is a ULA address. There is nothing in the address directly pointing to you, so publishing the full address is not enough on its own to identify you. However the next 48 bits are supposed to be globally unique, so correlation with ULA addresses published through other channels could be possible. So you might want to censor the following 40 bits.
fe80:: a link-local address. 10 bits is enough to know that it is a link-local address, but the next 54 bits are generally 0, so the first 64 bits are well known in this case.
That covers the common cases for the first 48 bits. The next 16 bits of the address are usually indicating which segment on your LAN is referred to. Since it is important to know whether two addresses are on the same segment or not, those 16 bits should not be censored, as they very often contain information of importance to your question.
The last 64 bits may contain your MAC address, as in this example:
fe80::220:40ff:fe30:20d7. Here the
ff:fe in the middle of the last 64 bits will indicate that it is generated from a MAC address.
0220:40 will indicate the vendor of the hardware, and
30:20d7 will identify the specific device within the series.
Don't censor all of the MAC address, as it is relevant to know whether two addresses are based on the same MAC address. I would consider
fe80::220:40ff:fexx:xxd7 to be a reasonable compromise. It will indicate the vendor, but not uniquely identify the device, and should you have a few successive MAC addresses from the same series, they can still be told apart by looking at the last bits.
2001:db8:5c1d:c698:220:40ff:fe30:20d7 was a full address, which I wanted to censor, I would write it as
2001:xxx:xxxx:c698:220:40ff:fexx:xxd7. All you can really tell from this address is that it is a globally routable address, and it was generated using the MAC address of some Motorola hardware.
Never write an address belonging to someone else when censoring an address. If you need to write out a full address and cannot write any
x somewhere in there to indicate that it is censored, there are a few options. For a ULA address you are allowed to replace the 40 bits after the initial
fd with a random value. If I used
fd59:f1b8:8740:: locally it would be acceptable for me to just write
fd8f:ed38:64da:: if I wanted to censor it. For a globally routable address anything starting with
2001:db8: is fair game for examples, like in my example above.