Tutorial: Server-Side IP Anonymization: GA4, Adobe Launch, and Jentis

Server-side IP reduction changes the address available to downstream services. A shorter address does not automatically make an event anonymous: identifiers, URLs and other fields can still link the event to a person. The practical task is to define which data may leave each system, apply that rule and inspect the resulting requests.

1. sGTM: define the output before configuring the tag

Google documents ip_override as the common event-data field for an IPv4 or IPv6 address. A client must first populate event data. The presence and meaning of an additional ip field depend on that client; an undocumented fallback can bypass the intended rule.

The server container needs a variable template with permission to read ip_override. The following example accepts only valid dotted-decimal IPv4 syntax and sets the fourth octet to zero. It rejects IPv6, missing values and malformed input. This is an IPv4 example, not a complete deployment for mixed IPv4/IPv6 traffic.

const getEventData = require('getEventData');
const createRegex = require('createRegex');
const testRegex = require('testRegex');
const makeNumber = require('makeNumber');
const ip = getEventData('ip_override');
const digits = createRegex('^(0|[1-9][0-9]{0,2})$');
if (typeof ip !== 'string' || !digits) return undefined;
const parts = ip.split('.');
if (parts.length !== 4) return undefined;
for (let i = 0; i < 4; i++) {
  if (!testRegex(digits, parts[i]) || makeNumber(parts[i]) > 255) {
    return undefined;
  }
}
return parts.slice(0, 3).join('.') + '.0';

After saving the template, a variable based on that template supplies the GA4 tag’s ip_override override. A separate trigger condition must block this example’s transmission whenever the variable has no value. An undefined value alone does not prove that the tag omits the original address; template fallbacks must be checked. A production IPv6 path needs a validated address parser and an explicit prefix rule.

Transformations can instead modify or exclude event parameters for selected tags. The selected tags and transformation order matter. Editing event data does not erase the incoming HTTP request or infrastructure logs.

2. Adobe: datastream obfuscation and geolocation are separate

Under Datastreams → Advanced Options → IP Obfuscation, Partial clears the final IPv4 octet or final 80 IPv6 bits; Full clears the whole address. Geo Lookup runs beforehand and needs separate limits. Downstream services can behave differently; for example, full obfuscation affects Adobe Analytics IP filtering. This is a datastream setting, not an Analytics-service “Mask IP Address” toggle.

3. Jentis: distinguish transformation functions from operating mode

Jentis documents dedicated IPv4 functions that randomize one, two, three or all address sections. Generic string pseudonymization can produce invalid IP syntax. Neither feature establishes a universal “last octet becomes zero” rule. The selected function, input type and destination require verification.

Essential Mode is separate: vendor and tag settings distinguish consent paths. Jentis describes substituting the server IP for third-party communication in this mode. The actual configuration must be inspected rather than inferred from the product name.

4. Location reports: measure the effect

Google states that GA4 derives location information during collection and then discards the IP before logging. Reducing the address upstream changes the input to that process. The resulting city and country accuracy depends on the address range, location database and collection path. A guaranteed increase in “(not set)” or guaranteed country accuracy cannot be inferred from removal of one octet.

For GA4 Measurement Protocol, user_location supplies explicit geography and takes precedence over ip_override. This is a separate interface; support must not be assumed for every sGTM tag. Geography derived locally still represents data sent to the recipient and needs its own documented scope.

5. Conversion APIs need destination-specific validation

An address with valid syntax is not automatically an acceptable substitute for the device IP expected by an advertising API. Meta uses user_data.client_ip_address; LinkedIn uses typed entries in user.userIds, with IPv4-only IP types currently documented. Neither field mapping proves support for arbitrary truncated addresses. A privacy rule may require omission or suppression of transmission, depending on required fields.

6. Verification before publication

1. The test set covers ordinary IPv4, compressed and expanded IPv6, missing data, malformed input and proxy-header lists. No failure path may silently restore the raw address.
2. Server preview checks cover every outgoing destination, payload and relevant header, including consent changes and all tag variants.
3. Location reports are compared against a documented baseline. Missing locations and shifts are recorded without assuming a fixed percentage.
4. Separate browser pixels and access logs require inspection; a server-tag change does not cover these paths.