How long should SE store IP addresses of users?

Question

Right now as far as I know, SE stores the IP addresses used to access any SE site forever. Every moderator or employee with moderator powers can see a list of every IP address a user ever accessed the site from.

IP addresses are considered personal data under the GDPR, and I think it is worth discussing how long they should be stored. They are often considered not particularly sensitive information, and in many cases they aren't. An IP address from a mobile phone provider won't tell much about you, and unless you can access or subpoena the provider, knowing the IP address doesn't really reveal anything. But there are also many different cases, and in some cases IP addresses can reveal a lot. If you access SE from a company computer, the IP address could identify which company you work for. They also can give a rough location of where you live and where you travel.

There is a legitimate need for SE to store IP addresses and to make them available to moderators. But keeping all the information indefinitely is a bit harder to justify. I could also imagine treating "well-behaved" users differently here than users suspended for rule violations that involved sock puppets. The curious thing here is that the users that get the most privacy are actually spammers, as their accounts are destroyed entirely.

Is it really necessary to store IP addresses forever, or would a shorter duration be enough? Alternatively I could imagine simply restricting the visibility of historical IP addresses, as there isn't really a need to look them up on their own.

Answer 1

I've thought about this for a while - and perhaps its worth reframing the question in terms of what sort of information we need, and how this information is best stored, and shared in a way that meets both privacy, and the operational requirements of both mods and the folks who run the site.

TLDR: Its worth considering alternatives to exposing IPs to mods.

As mods we don't actually need access to IPs - If we had a way to reliably, as opposed to semi reliably, ascertain that a certain a user is from the same rough geographical region or ASN, did a reverse DNS look up on the IP. We have a specific, on demand took for Reverse DNS lookup and geo-ip but it sometimes fails.

Fundamentally we need to know if user A and B are linked in some way, and be able to cross reference them

It would also be telling if a user in good standing suddenly went bad, and they suddenly switched locations - which might indicate an account compromise. This might happen after a period of time, especially if the account was abandoned.

Likewise knowing that a certain user shares an ISP/network range (and fuzzy searching on non identical/similar IPs would be nice!).

More or less, for us not to need to store/look up IPs - we'd need the functionality to store/look up what we really need: The relationships between accounts .

So any replacement would be some way to look up relationships between users in terms of 'where' they are. We have part of this, though its IP based at the moment.

I'll leave it to folks to decide if a more general/abstracted way to keep track of users than IP is "good enough"

If we had this, working completely reliably (and the SE reverse look up tool can be a bit... janky) I suspect mods might have almost no need for IPs.

I can't speak for the needs of the company - but I'd think the 'right' approach would look into where specific IP is used, and how-if it can be likewise aggregated in some forms that meets the requirements they have. I'd suspect that there is/ought to be pretty robust tracking of people looking up PII and various safeguards. but I can't really comment on them.

So practically - its hard to decide what's the right amount of time , but its worth exploring alternatives to storing or exposing IPs as another way to do it.

Answer 2

Thanks for pointing this out, this is a great question. Our moderators are very technical, and one benefit of that is we can always appreciate you to bring these things up as they come to your attention. We can’t go too deeply into how we store, and our plans around storing IPs due to security reasons. That being said, one big project we have underway across the engineering organization is a data audit specifically around GDPR compliance. The length of time we store IPs is one of the things on a long list of the things we plan on looking into. We're always thinking about our data retention policy, and ensuring we’re thoughtful about GDPR, user safety, and customer security is a priority.

Answer 3

I'm not sure whether the GDPR as a european regulation is applicable to stackexchange or stackoverflow since the webservers are located in USA and the DB-Server in Canada. Using this service you should be aware that everything you ask resp. post is transmitted into the USA. The privacy notice says:

How long will we use your personal data?

We will keep your personal data only for as long as is necessary for the purposes set out in this privacy notice and to fulfill our legal obligations. We will not keep more data than we need. While you remain a user of the Public Network, we will retain your data in order to keep providing services to you.

We are required to keep some basic information about our customers for a longer period in accordance with applicable tax laws. In some circumstances you can ask us to delete your data.

Furthermore the privacy note tells specifically about the purposes and taht you can ask for your data stored here and also revoke your approval to use your data.

So, in general, if you use this service, you agree that your data is stored according to the privacy note. If you don't want that, don't use it.