Understand capturing IP addresses on form submission
Forms in your Zoho Creator app can capture the public IP addresses users submit their entries from. You can enable this using the Capture IP address form property. Refer to this page to learn how to manage the capturing of IP addresses by your forms.
Apart from the Capture IP address form property, the public IP address of the current user can be fetched using the variable zoho.ipaddress. In case you have used this to capture your user’s IP address in a separate field, we urge you to adhere to the data privacy guidelines of GDPR — refer to the following section.
Data Privacy & GDPR
Up to May 24, 2018, IP addresses were captured on form submission by default. For the forms you created up until this date, the Capture IP address property is be enabled automatically, and your users' IP addresses will continue to be captured on form submission. This is to ensure that the processes managed by your apps do not suffer if they rely on this data.
From May 25, 2018, in compliance with the data privacy guidelines of the General Data Protection Regulation (GDPR), the way capturing IP addresses works will change:
- All forms you created prior to this date will continue capturing your users' IP addresses. However, if you do not require this data, we recommend that you uncheck this property. When you do so:
- IP addresses will no longer be captured
- The IP addresses previously will be deleted
- The forms you create from this date forward will capture your users' IP addresses (on form submission) only if you enable the Capture IP address form property. The instant you uncheck this property, capturing IP addresses will cease and IP addresses captured will be deleted.
If you're capturing IP addresses on your forms, we recommend that you clearly inform your users about why you require their IP address, and how will this data be used and processed downstream. In the context of GDPR:
- IP address is considered personal data — data that relates to a natural person
- The Data Subjects (your users) have the right to be informed on why their personal data (IP address) is required, and how it will be stored and processed downstream
- You are the Data Controller for all apps in your workspace, and it's your responsibility to inform them what you are capturing, and proceed only when you have a lawful basis to do so
A way to keep your users informed
If capturing IP addresses is required for any downstream, you do not need to provide a consent mechanism. However, you must inform your users why you're capturing their IP address, and what you will be doing with it. To do this, you can add an add notes field to your form and explain.
Where is the captured IP address stored?
When a user submits an entry through your form which has the Capture IP address option enabled, Zoho Creator fetches their IP address and stores it in the Added User IP Address system field. When a your user updates a record through forms, their IP address is stored in the Modified User IP Address system field.
