Website Personalisation

[humbertoby8212]

The marketing division of our company is considering implementing website personalisation. The solution uses a visitors IP address to identify the businesses that are visiting our website. They provide us with the name of the business and further details such as industry, revenue etc. Using this data, we can then dynamically tailor the content of our website to show our visitors the most relevant information.

The solution never identifies individuals and only identifies businesses that have 10 or more employees. Our vendor has also confirmed that they only capture the IP address of the visitor and no other points of entropy that would allow an individual to be fingerprinted.

Will the proposed solution stop the website personalisation tool from being able to access the IP address and therefore stop it from working? If so, is there token or something similar that could be issued to allow the tool to access the IP address?

[npdoty]

I believe a goal of most IP privacy work (whether MASQUE proxy, or willful IP blindness) would be to prevent disclosure of information about the user based on their IP address, in this case their employer (or the owner of the network from which they're connecting).

Users often may not wish to have a website automatically customized to their employer/network provider. But for users who do want that customization, it should be possible to ask a user to volunteer their employer, which can be done within the Web content. That would also work for customers who want to let you know their employer but aren't connecting through the employer's network, and makes it easier to get the user's consent.

This draft at IETF contains some documentation of the privacy implications of IP addresses, including "Determine who owns and operates the network": https://datatracker.ietf.org/doc/draft-ip-address-privacy-considerations/