The visitor's IP address stops at the gateway.
Server-side tracking normally means your container, and every vendor it forwards to, receives the raw client IP. The Anonymizer removes that. IP addresses are masked or dropped at the gateway, before your container sees the request, so there is no raw address to leak, log or forward.
Mask mode shown. The network part survives so country-level geo still resolves; the host part is gone before your container is reached.
What your container receives
The IP address is the hardest identifier to control
It arrives on every request, before any consent logic runs, and it is the one piece of personal data you cannot switch off in a tag. Once it reaches your container, controlling where it goes becomes your problem.
It is personal data under the GDPR
European regulators and courts have treated IP addresses as personal data for years. Anything that receives one becomes part of your processing chain and your records.
It arrives in more than one header
Blanking X-Forwarded-For is not enough. The same address also travels in X-Real-IP, Forwarded, True-Client-IP and CF-Connecting-IP, and a vendor only needs one of them.
Tag-level settings come too late
An anonymisation toggle inside a tag runs after the address has already reached your container and been written to logs. The only reliable place to remove it is in front.
How it works
The module rewrites the client-IP headers on every request to your tagging domain. Choose the mode that fits your risk profile; both are enforced at the gateway, not in your tags.
Mask mode
The host part of the address is zeroed: 203.0.113.42 becomes 203.0.113.0, and IPv6 addresses are truncated to roughly a /48. Country-level location stays derivable, the individual does not.
Remove mode
Every client-IP header is blanked. Your container receives no address at all, in any format, and cannot forward one even by accident.
Fail closed
If an address does not match a shape the module recognises, the header is dropped instead of passed through. An unexpected input can never result in a raw address slipping past.
What you get
Five headers covered
X-Forwarded-For and X-Real-IP are rewritten; Forwarded, True-Client-IP and CF-Connecting-IP are always blanked, because they carry the same address in other formats.
Geo survives masking
Location is resolved from the real address at the gateway before headers are rewritten. Combined with GEO Headers you get coarse location and no IP, the GDPR sweet spot.
Applies to every request
There is no sampling and no tag-by-tag opt-in. Every request that reaches your tagging domain is treated the same way.
Nothing to configure in GTM
Your tags do not change. They simply stop receiving something they were receiving before.
Specification
- Mode
- mask (default) or remove
- IPv4 masking
- Host octet zeroed (/24)
- IPv6 masking
- Truncated to approximately /48
- Applies to
- Every request to your tagging domain
- Cost
- Included with your container
When to use it
You need a defensible privacy story
Being able to state that raw IP addresses never reach your tag server, and never reach any vendor, is a materially stronger position than 'our vendor anonymises them for us'.
You forward data to vendors outside the EU
Removing the address before it is forwarded shrinks what actually crosses a border, which is the part of a transfer assessment that tends to get scrutinised.
You still need country-level reporting
Run it in mask mode. Regional reporting keeps working because the network part of the address survives; the individual household does not.
Questions about the Anonymizer
Does masking break GA4 or Meta reporting?
Geographic reporting keeps working at country and usually region level, because the network part of the address is preserved. What stops working is anything that depends on identifying a specific household, which is the point of the module.
Should I choose mask or remove?
Mask is the sensible default: it keeps coarse location usable. Choose remove when your policy is that no form of the address may reach your container, or when you get location from the GEO Headers module instead and have no remaining use for the address.
Does this replace consent management?
No. It reduces what you process, which is a different obligation from establishing a lawful basis for processing it. The Anonymizer complements your consent setup rather than substituting for it.
Other modules
Modules stack. Enable as many as you need. They compose into one configuration in front of your container.
Ready to switch it on?
Every module is included with your container at no extra cost. Create a container, open the modules panel, and toggle.