Is it illegal to track website visitors' ip addresses? If so, what precautions can you take to make sure you're covered?

Question

Essentially what I'm wanting to know is, if I set up my website to collect user IP addresses using a mysql database to see when they first visited + when they last visited and other info like what pages they have visited on my website, do I have to put a privacy policy to let the users know this is going on?

Also, do I have to provide proof of what it is their data will be used for?

To be more specific, this is my portfolio/blog that I'm making with this feature and I don't know if my efforts are worth it.

Thanks.

//This is the php code that grabs the IP address.

if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
    $ip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
    $ip = $_SERVER['REMOTE_ADDR'];
}

Also, I'm not associating their IP with who they are necessarily, but I'm using it to distinguish between 2 users because they may view different things.

Edit: This is for my professional portfolio/blog.

Answer 1

Generally, web servers store those details in a log file in anyways. Info like: IP Address, Time of Visit, Referal URL etc. So, in my view, it should be perfectly all right store and analyse these info based on the need.

Also, instead of coding, storing and analysing, i would recommend you to use Google Analytics which will give you greater details about user behaviour.

With regards to IP, there are other tools available (Like: Open Tracker) and you can integrate by placing their JS and it collects a massive amount of info with IP, page visit and much more.

Coding on your own may be an overhead unless there will be no option out there.

Answer 2

It's not illegal. Often it's encouraged for security purposes to know if an IP keeps spamming visits to your site, so that the server can better determine if it's a possible DDOS (Distributed Denial of Service) attack. You also might use that IP address for login/logout purposes. This information is often used for website analytics purposes, such as what you're doing here.