Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This one is a bit tough. It is publicly available information, is it not? But it's can also be used maliciously. So is it legal/ethical to store and/or gather information on users based on IP? It's mostly for curiosity, but it would also be important for marketing purposes, and maybe something to anonymously post on the homepage.

One use for this is detecting attacks and, for some products, limiting your release to one part of the world. I can see no real downsides from a business point of view, but I can also see how it would make users feel uncomfortable, and may actually be illegal.

Right now, I'm simply storing the user-agent and ip strings in a slightly randomized line-break format, so if a vulnerability is found by a web bot, there's less of a chance for ips to be properly scraped. But I'd like to eventually compile a map of users, and put a little dot where each user logged in. It would be a world-wide map, so the fine details would not be disclosed. But for some reason, I feel like I'm guilty of something or will get into trouble for collecting this data.

On the legal side of things, I've noticed articles similar to this:, and I've read about companies like Google and Facebook getting into hot water with users for collecting data.

I am in the United States, and the server will most likely operate somewhere in the US, but I have the impression that the per-country laws pertained to the client visiting.

share|improve this question

closed as off-topic by gnat, Bart van Ingen Schenau, GlenH7, MichaelT, Dynamic Dec 8 '13 at 23:35

  • This question does not appear to be about software development within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

Sharing your research helps everyone. Tell us what you've tried and why it didn’t meet your needs. This demonstrates that you’ve taken the time to try to help yourself, it saves us from reiterating obvious answers, and most of all it helps you get a more specific and relevant answer. Also see How to Ask – gnat Dec 5 '13 at 3:53
It depends on what data you store and where your service operates. – Christian Dec 5 '13 at 4:10
I've specified what data I'm currently storing, and will most likely store no more. I'm looking to operate my service in America, but if not, it will most likely be somewhere in Europe. – Dylan Katz Dec 5 '13 at 4:27
This question appears to be off-topic because it is tour legal matters. – gnat Dec 5 '13 at 6:25
@gnat: he's asking about ethics first and law second. Ethics of programming are absolutely on-topic here. – DougM Dec 5 '13 at 14:38
up vote 7 down vote accepted

You asked two very different questions.

Is tracking user metrics by IP legal?

I'm about 98% sure that keeping your log of HTTP requests and extracting the IP address of each session, and then building a geographic distribution of where your users are based on said IP address is perfectly legal everywhere in the globe.

But asking "is this thing that I'm doing legal" is asking for legal advice, and you shouldn't get legal advice from strangers on the internet. As far as I know you could be under a court order making it a misdemeanor or felony for you to even use a website. If you want legal advice, find a lawyer.

Is tracking user metrics by IP ethical?

Yes. Absolutely, emphatically yes. People complain about some of the tracking that Google and Facebook do, but that's the explicit contract those same users make when they use those websites.

The only possible requirement you might have is to honor "do not track" settings in web browsers, and to take some reasonable effort to both secure individually identifiable records and dispose of them once you no longer have a need.

(In the early days of the web, EVERY http request was tracked and logged. Most still are by default, although most admins have the logs set to delete very quickly so they don't have to deal with subpoenas from law enforcement.)

share|improve this answer
Thank you. I would find a lawyer, but I'm young and broke. – Dylan Katz Dec 5 '13 at 5:00
A lot of lawyers are young and broke these days, too. Depending on your state, you might be able to get a cheap referral from your state's bar association or a local school, or there may be legal guidance from a small business association or university. – DougM Dec 5 '13 at 5:06
Storing full email addresses is already slightly problematic in Germany. – CodesInChaos Dec 5 '13 at 10:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.