I'm creating a website where I collect the name, email, state, and an optional photo of a user. Before the user submits the form, they have to agree to the terms of the site. For testing and statistics, i'd like to collect IP address and user agents. Do I have to let the user know i'm gathering this on the terms page?

  • What country are you in? Different countries have different privacy laws. Commented Aug 12, 2011 at 12:53
  • I'm in the United States
    – Dan
    Commented Aug 12, 2011 at 12:54
  • 3
    As an aside - the big two web servers - Apache and IIS - collect this information for every request to your site - pages, images etc. Commented Aug 12, 2011 at 13:23

2 Answers 2


As paulmorriss mentioned in the comments, most major web servers do this automatically anyways, with their server logs. These logs contain UA strings, IP addresses, and much more.

I don't know of any law on the books that would explicitly forbid this, but I would say that you should probably include in the Terms of Service the fact that you collect this information for statistical purposes.


Major search engines do this too.

After a period (between 6 and 18 months), logs have all the IPs replaced by another unique identifier generated randomly for each IP. That way you can measure user behavior without identifying the user.

You can do this immediately instead by converting IPs into something else using a hash and tagging with Geo-Location information (for example). That way you do not keep user's actual IP but you have enough information to do the certain types of analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.