How Server-Side Tagging (sGTM) Enables IP Address Transformation for Privacy

Google Tag Manager’s server-side tagging offers numerous possibilities, particularly in enhancing privacy controls and ensuring compliance when collecting and dispatching data to your marketing and analytics vendors.

In this guide, I’ll walk you through some key capabilities server-side tagging provides for securely handling IP addresses.

IP addresses can be considered Personally Identifiable Information (PII) and play a crucial role in measurement and analytics.

An Internet Protocol (IP) address is a unique identifier assigned to every device connected to the Internet, classifying it as «non-sensitive PII.»

And, if you’ve already transitioned to server-side tagging in Google Tag Manager or are considering switching.

In that case, this guide will help you understand the privacy controls available for anonymizing and transforming user IP addresses before sending data to Google Analytics or other MarTech vendors.

Doing this can help reduce their sensitivity before sharing them with vendors and comply with Privacy laws that cover your business identity.

While server-side tagging offers various privacy features, this guide focuses explicitly on IP address handling.

What transformation and anonymization capabilities does server-side tagging provide for privacy compliance?

• Google Analytics (GA4) IP Address Redaction Settings
• IP Address Anonymization
• Static IP Address Replacement with Dynamic Option
• IP Address Hashing

Everything covered in this guide can be implemented using either the «IP Transformer/Anonymizer« server-side custom template variable I (Jude Nwachukwu Onyejekwe) created at DumbData or other methods discussed here.

GA4 IP Address Redaction Settings:

If you’re sending data to Google Analytics via server-side GTM (sGTM), you have the option to enable the «Redact visitor IP address» setting, which is built directly into the GA4 server-side GTM tag.

Enabling this setting redacts (removes) the visitor’s IP address from event data, meaning reports based on these events will not include geographic information.

This functionality is similar to the «Granular location and device data collection» setting found in the Google Analytics UI under Admin > Data Collection.

The IP address redaction setting in the server-side GA4 tag ensures that Google Analytics does not process the user’s IP address, preventing GA4 from reporting location data derived from it. Since the IP address is not processed, geo-location insights based on the IP address are unavailable.

However, it’s important to note that region and country-level metadata are still required for Google Analytics to support regional privacy policies and region-based analytics settings.

If you enable the sGTM GA4 IP redaction setting, you can still use the «Enable region-specific settings» option in Google Analytics to comply with regional privacy regulations.

Alternative Redaction Option: Using the DumbData «IP Transformer/Anonymizer»

Alternatively, you can use the DumbData «IP Transformer/Anonymizer« sGTM variable, which offers a robust solution for IP address transformation and anonymization, including the ability to redact IP addresses (IPv4 and IPv6).

This feature intercepts the user’s IP address in the request sent to your tagging server and transforms it into «0.0.0.0» for IPV4, effectively anonymizing the data and preventing the exposure of user IP addresses.

If you’re using this for GA4 requests, you can leave the «IP Address Source» option set to its default value, «Read from Event Data», as the variable will automatically read the IP address sent with the request from the value of the «ip_override» parameter.

However, if you’re working with other data sources, select the «Variable Value» option and enter the variable that contains the IP address, as shown in the image below.

This method is especially useful when you’re not using Google Analytics but still need server-side GTM transformations to apply IP anonymization to your tags.

IP Address Anonymization:

Another method is IP anonymization, which functions as a masking technique instead of redacting the user’s IP address; this method helps with removing specific portions of a user’s IP address before sending the data to Google Analytics or any other vendor tag in your server-side GTM (sGTM) setup.

One way to achieve this is by using the «IP Anonymizer« sGTM custom template variable, which can be added directly from the GTM Template Gallery.

This variable anonymizes any IPv4 or IPv6 address by removing the last octet (for IPv4) or hex segment (for IPv6) before you can pass the data forward.

For example, if a request is received with the user’s IP address as 192.168.123.132, the anonymization process removes the last octet, transforming it into 192.168.123.0.

More Robust Alternative: The DumbData «IP Transformer/Anonymizer» Variable

While the anonymization method made available by the variable template is useful, it is limited to removing only the last octet. If you need greater flexibility, you can use the DumbData «IP Transformer/Anonymizer» custom template variable, which can also be added from the GTM Template Gallery.

This variable provides multiple IP anonymization methods, including:

• Removing octets (IPv4) or hex segments (IPv6)
• Redacting IP addresses
• Hashing IP addresses
• Replacing IP addresses with a static value

Unlike the anonymization method used by the «IP Anonymizer» variable template, the «IP Transformer/Anonymizer» variable gives you complete control and allows you to remove up to three octets for IPv4 (or hex segments for IPv6), offering more granular control based on your privacy requirements.

For example, if you choose to remove the last two octets, 

an IP address like 192.168.123.132 will be transformed into 192.168.0.0 before being sent to the vendor.

If you opt to remove the last three octets, even further anonymization will be applied to the resulting IP address.

There is also an option of removing the last octet/hex if you want to remove just the anonymize, just the initial part.

For example, 192.168.123.132 will be transformed into 192.168.123.0

Although the examples above use IPv4, the «IP Transformer/Anonymizer» variable also fully supports IPv6, ensuring robust anonymization for all types of IP addresses, including IP addresses with port numbers.

Static IP Address (With Dynamic Option):

In some cases, you may choose not to send any part of the user’s IP address at all. Instead, you might prefer to use a predefined static IP address or generate a dynamic one to replace it.

Also, with the «IP Transformer/Anonymizer» variable template, you can achieve this by selecting the «Static IP Address» option. Once selected, you’ll need to enter either:

• A fixed static IP address
• A dynamic variable that generates an IP address

Alternatively, you can leverage server-side GTM’s transformation capabilities to handle this process manually using a custom variable.

IP Address Hashing:

Another available method is IP hashing, which is useful when working with vendors that require hashed IP addresses for compliance or data security purposes.

The «IP Transformer/Anonymizer» variable allows you to hash IP addresses by selecting the «Hashing» option.

Once selected, additional configuration settings appear, allowing you to choose the hashing format (e.g., SHA-256).

If you prefer a separate tool, you can use the «SHA-256 Hasher« custom template variable, which provides the same hashing capability.

Conclusion:

Now, you understand various IP anonymization and transformation techniques available in Google Tag Manager server-side tagging and how to implement them.

In the comment, I’d like to know which of the techniques you are already using or will be leveraging in your next implementation project.

If you have any questions or need assistance with sGTM or analytics, feel free to connect with me on LinkedIn.

Also, if you’d like to share your thoughts, drop a comment below.