Speed tests and your IP address

TL;DR

Like all websites, speed tests must use an IP address in order to function. It can be deduced from the various privacy policies that the IP address may appear in the logging. However, for almost all speed tests it is impossible to find out exactly what happens to the IP address.

A positive exception is Cloudflare. The text in their information banner is clear and to the point.

 

Contents

  1. Introduction
  2. Method of measurement
  3. Speed tests to test
  4. The measurements
  5. Conclusions
 

Introduction

When you request a web page, an IP address is passed to the web server where the web page is located. You cannot prevent an IP address from being passed on. This is an inherent property of the Internet protocol that forms the basis for all Internet traffic.

Note that internet protocol (IP) addresses are personal data according to the GDPR.

There are two options to prevent your IP address from being sent to a web server:

  1. Use the TOR browser
  2. Use a virtual private network

Unfortunately, both techniques affect your internet speed. In short: Your internet speed cannot be measured when using TOR. If you use a virtual private network, it can affect your internet speed (it depends on the VPN used).

Fortunately, most speed tests have a privacy policy that should explain how the speed test handles your IP address.

In this test we check whether and, if so, what it says in the privacy policy about the use of the IP address.

 

Method of measurement

For this test, we visit the speed test privacy policy and do a manual inspection to find information regarding the IP address. We do this by searching address in the pricacy policy.

 

Speed tests to test

For this test we tests the privacy policies as mentioned at Speed tests with a privacy policy.

 

The measurements

  1. Astound speedtest has a privacy policy that contains the following information about the use of an IP address:
    1. (...) In order to provide our services to you and for other reasonable business purposes, we keep business records that contain personal information. In particular, we collect and maintain the following categories of information about you to the extent permitted by law, including within the last 12 months: Identifiers such as your name, user names, home and work e-mail and postal addresses, Astound account number, Internet Protocol (“IP”) addresses, (...)
    2. (...) Except for communications you send to us directly, Astound does not actively monitor the content of any online communication (...) except as permitted by applicable law, and may use an automated system to randomly audit such transmittals to protect our network from viruses, worms, and excessive spam. In most cases, network traffic monitoring is restricted to viewing source/destination addresses, and the content of the transaction is not viewed. Astound will view the content of online communications only when it is necessary to protect the security of Astound’s network or ensure system reliability. (...)
  2. Bandwidth Place has a privacy policy that contains the following information about the use of an IP address:
    1. (...) On some pages, you can order products, sign up for website, news, submit a feedback form, and services, make requests, or participate in surveys. The types of personal information collected at these pages may include: (...) IP address (...)
    2. (...) we may provide non-identifying aggregate statistics and performance results of the number of people that used the speed test tool, connecting with a certain broadband provider or technology in a certain region of the world (...)
  3. Bredbandskollen has a privacy policy that contains the following information about the use of an IP address:
    1. (...) The Swedish Internet Foundation must handle IP addresses, identification codes and positioning data, which may be personal data. IP addresses count as personal data if they can be connected to a physical person (for example, if one has their own web server) but for most internet users, the IP address only points to their broadband operator. The Swedish Internet Foundation cannot identify any of Bredbandskollen’s users from IP addresses without additional information transmitted from the broadband provider. The Swedish Internet Foundation will not retrieve information to identify users, beyond the IP address. The IP address is being processed to perform your measurement and deliver a result to you (...)
    2. (...) When you perform a measurement with Bredbandskollen, a catalogue service from a provider is used to see which broadband operator is providing your IP address and also to know where the broadband operator who has the IP address is located geographically (...)
  4. Broadband Speed Checker has a privacy policy that contains the following information about the use of an IP address:
    1. (...) When you visit our site, we use cookies and automatic logging (see 'Cookies and Log Files') to collect information including but not limited to browser information, IP address, Location (estimated), site links (...)
    2. (...) The IP address information we collect is not associated with you or any other individual and, for this reason, is not Personal Information (...)
    3. (...) If you use our Speed Checker Scheduler application, we may provide the internet connection quality information to third parties without any personal information with the exception of your IP address (...)
    4. (...) Our systems automatically gather some anonymous information about visitors, including IP addresses, browser type, language, and the times and dates of webpage visits. Unless otherwise indicated in this privacy policy, the data collected includes personally identifiable information and is used as described above, such as for statistical analysis, to understand user behaviour, and to administer the site (...)
    5. (...) Our website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). (...) Google will not associate your IP address with any other data held by Google. (...)
  5. Cloudflare has an information banner that contains the following information about the use of an IP address:
    1. (...) When you use Speed Test, Cloudflare receives the IP address you use to connect to Cloudflare’s Speed Test service. Cloudflare uses your IP address to estimate your geolocation (at the country and city levels) and to identify the Autonomous System Number (ASN) associated with your IP address.

      Cloudflare shares anonymized measurement information (e.g., the estimated geolocation, ASN associated with your Speed Test, etc.) with our measurement partners as part of Cloudflare’s contribution to a shared Internet performance database. We do not share your IP address with our measurement partners. (...)
    2. (...) Cloudflare truncates your IP address that it receives as part of your use of the Speed Test to /24 and /48 for IPv4 and IPv6 addresses, respectively. (...)
  6. Comparitech has a privacy policy that contains the following information about the use of an IP address:
    1. (...) Comparitech may collect the following information from you when you use the Website (collectively, the “Data”): (...) certain technical/analytical information collected by Comparitech when you use the Website such as IP addresses, times and methods of your requests, browser and operating system types and other usage data such as pages you visit, for how long and the frequency of such visitations (“Analytics Data”) (...) information obtained via the use of certain tools hosted on tools.comparitech.com, (“Tools Data“)including your Internet Protocol address (IP address) (...)
    2. (...) The Tools Data is used by us in terms of two specific tools: (i) a DNS leak test (...) and (ii) a speed test (...)
    3. (...) The Cookies Data and Analytics Data is collected to enable Comparitech to monitor and analyse web traffic and can be used to keep track of visitor behaviour on the Website (...)
    4. (...) It is in Comparitech’s legitimate interests to collect the Cookies Data and Analytics Data because this is necessary in order to provide and improve the Website (...)
  7. DSLReports has a privacy policy that contains the following information about the use of an IP address:
    1. Nothing
  8. Fast has a privacy statement that contains the following information about the use of an IP address:
    1. (...) We collect information about your use of our service, your interactions with us, as well as information regarding your network, network devices, and your computer, mobile phone or other internet connected devices you might use to access the Fast.com internet speed testing service (such as gaming systems, smart TVs, mobile devices, and set top boxes). This information includes: (...) device and software characteristics (such as type and configuration), connection information such as speed and latency measurements, connection type (wifi, cellular), referring source (for example, referral URLs), IP address (which may tell us your general location and internet service provider (ISP)), browser and standard web server log information (...)
    2. (...) We use information to provide, analyze, administer, enhance the Fast.com speed testing service and the Netflix service performance. For example, we use such information to: determine your general geographic location, localize the experience, determine your ISP to support network troubleshooting (we also use aggregated ISP information for operational and business purposes). We may also use aggregated information to encourage and assist ISPs to improve network speeds (...)
  9. Fireprobe has a link to the privacy policy in the footer that contains the following information about the use of an IP address:
    1. (...) The applications may also obtain your public IP address and data like device, network or system information for statistical and diagnosis purposes (...)
    2. (...) We may share collected information (test results, device and network details, location details) with third parties (internet service providers, regulators etc.) for statistical and network diagnosis purposes (...)
  10. Google Fiber has a privacy policy that contains the following information about the use of an IP address:
    1. (...) We also collect information about the interaction of your apps, browsers, and devices with our services, including IP address, crash reports, system activity, and the date, time, and referrer URL of your request (...)
    2. (...) We use the IP address assigned to your device to send you the data you requested (...)
    3. (...) We collect and analyze IP addresses and cookie data to protect against automated abuse (...)
  11. Internet Speed at a Glance has a privacy policy that contains the following information about the use of an IP address:
    1. (...) When you use the internet you use a computer, tablet or something similar. To do this your computer needs to have an Internet Protocol address (an IP-address). This IP-address is sent with your request to a webserver so that the webserver knows where to deliver the requested webpage. The problem is that your request (and the result sent by the webserver) pass a lot of webservers which all are able to log this information. There are two webservers which certainly will be used. The webserver of your Internet Support Provider and the webserver where the requested webpage is hosted (...)
    2. (...) The domainname ZOMDir.com is registered by Vimexx and powered by Google's Appengine. When you request a webpage of ZOMDir.com Google Appengine will log your IP-address (...)
    3. (...) Although your IP-address will be logged, ZOMDir is not interested in the used IP-addresses. ZOMDir will not publish or distribute the logs with IP-addresses. However ZOMDir may release these logs with IP-addresses when this is appropriate to comply with the law (...)
  12. LibreSpeed has a link to the privacy policy at the web page that contains the following information about the use of an IP address:
    1. (...) At the end of the test, the following data is collected and stored: (...) Approximate location (inferred from IP address, not GPS) (...) Test log (contains no personal information) (...)
  13. M-Lab has a privacy policy that contains the following information about the use of an IP address:
    1. (...) Data Collected When You Run Tests (...) Connection Data: Information necessary to characterize performance data, including the Internet Protocol (IP) address of the client that conducted the measurement and the date and time of the test (...)
    2. (...) We may collect data about how you interact with M-Lab, like when you visit our website, hereafter referred to as “Website related data”. This data may be collected, processed and analyzed using Google Analytics: Log data: When you use M-Lab services or view M-Lab content, we may automatically collect and store certain data in server logs (records of the page requests made when you visit our sites). This may include: details of how you used our platform; Internet protocol address; device event data such as crashes, system activity, hardware settings, browser type, standard HTTP request headers, including but not limited to user agent, referral URL, language preference, date and time; and cookies that may uniquely identify your browser (...)
    3. (...) Measurement data and connection metadata is collected. This includes the IP address of the ISP provided on-premise device, or the IP address of your router, modem, etc. that receives an IP address from your provider. The time of test (timestamp) and the machine environment (e.g.: browser used and operating system) are also collected (...)
    4. (...) M-Lab is committed to data privacy and specifically one of its core principles: data minimisation. As such, we will not request a copy of your ID to prove your identity. Because we collect only your IP address at the time the test is run, we have no means of proving the test data belongs to you. Should you wish to exercise the rights listed above, we require proof that this IP address belonged to you at the point in time when you conducted an M-Lab test. Such proof could be provided in the form of a written confirmation from the resource holder (‘owner’) of the IP block your IP address is part of, for example your Internet Service Provider (...)
    5. (...) Your test data is made public under GDPR Art.6.1.f legitimate interest. The data disclosed includes your IP address, date and time (...)
  14. Meter.net has a privacy policy that contains the following information about the use of an IP address:
    1. (...) I want to inform you that whenever you use my Website, I collect log files mostly for security and optimisation reasons. This Log may include information such as your device Internet Protocol (“IP”) address, browser user agent, the time and date of your use of the Website, and other statistics (...)
    2. (...) I may employ third-party companies and individuals due to the following reasons: To facilitate our Website; To provide the Website on our behalf; To perform Website-related services; or To assist us in analyzing how our Website is used. I want to inform users of this Website that these third parties have access to your Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose (...)
  15. N Perf has a privacy policy that contains the following information about the use of an IP address:
    1. (...) When you use our Applications and Website, we collect the following technical information about your connection and browsing (hereinafter the "Technical Information"): (...) IP address (...)
    2. (...) NPERF may transmit your non-anonymized IP address to your telecommunications operator with your test results, to the exclusion of any other telecommunications operator, for the exclusive purpose of analyzing the quality of the networks and technical diagnoses, to the exclusion of any other purpose, in particular for marketing or commercial purposes (...)
    3. (...) By exception, your collected IP addresses may be communicated not anonymized to your telecommunications operator alone on the express condition that these IP addresses are used by the latter only for exclusive technical diagnostic purposes, to the exclusion of all other purposes (including marketing and commercial purposes) (...)
    4. (...) NPERF, as part of the NPERF Test, also collects the IP address of the User, their geographical position as well as the technical telecommunications data (...)
  16. Ookla Speedtest has a privacy policy that contains the following information about the use of an IP address:
    1. (...) We also collect other kinds of information from you or other sources, which we refer to as “Other Information” in this Policy, which may include but is not limited to: (...) Non-precise information about the approximate physical location (for example, at the city or zip code level) of a user’s computer or device derived from the IP address of such computer or device (“GeoIP Data”) (...) Internet Protocol (“IP”) address, which is a unique string of numbers automatically assigned to your device whenever you access the Internet (...) Log files, which may include IP addresses, browser type, ISP referring/exit pages, operating system, date/time stamps and/or clickstream data, including any clicks on customized links (...)
    2. (...) We and our partners (including but not limited to e-commerce partners, affiliates, and analytics providers) also may use technologies such as pixel tags, e-tags, IP addresses, Local Shared Objects, Local Storage, Flash cookies and HTML5 to analyze trends; administer the Services; collect and store information such as user settings, anonymous browser identifiers and video viewing history; supplement our server logs and other methods of traffic and response measurement; track users’ location and movements around the Services; gather demographic information about our user base; and to improve our understanding of traffic on the Services, visitor behavior, and responses to promotional campaigns. We may receive reports based on the use of these technologies by these third party companies on an individual and aggregated basis. For example, we may connect information about your IP address to known corporate or User Information and use the associated information related to aggregate content preferences to assist in our efforts to market services to you or the originating corporation(s) (...)
    3. (...) We may also engage third parties for the purpose of recognizing our users and delivering interest-based content and advertisements to them. We may share your User Information with our partners such as your name, postal address, email, or other identifier. Our partners may also: (i) collect information directly from your device, such as your IP address, device ID, advertising ID, and information about your browser or operating system; (ii) combine User Information about you received from Ziff Davis with information about you from other sites or services; and (iii) place or recognize a unique cookie on your browser. (...)
  17. Open Speed Test has a privacy policy that contains the following information about the use of an IP address:
    1. (...) We automatically receive information from your web browser or mobile device. This information includes the name of the website from which you entered our Website, if any, as well as the name of the website to which you’re headed when you leave our website. This information also includes the IP address of your computer/proxy server that you use to access the Internet, your Internet Website provider name, web browser type, type of mobile device, and computer operating system. We use all of this information to analyze trends among our Users to help improve our Website (...)
  18. SpeedCheck has a privacy policy that contains the following information about the use of an IP address:
    1. (...) We may also collect information that your browser sends whenever you visit our Service or when you access the Service by or through a mobile device ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data. When you access the Service by or through a mobile device, this Usage Data may include information such as the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data (...)
    2. (...) Data we collect when you run a speed test with Speedcheck on any of your devices, on any platform or the web: (...) Location Data: If a device supports precise location (based on GPS, mostly the case for smartphones) and you have granted access, we record precise device location. We also record non-precise location information based on the IP address a test is run from. Additional Metrics: We also collect additional points that are interesting in order to measure and analyze network and internet performance. These include but are not limited to the IP address you run a test from, the network operator (ISP) as well as device, network and hardware identifiers such as Wi-Fi names (SSID) or SIM card identifiers (IMEI) (...)
    3. (...) If you consent to background data collection (your consent can be changed anytime in App Settings), then Speedchecker Ltd (“SpeedChecker”) will collect the following information: (...) Pseudonymized device identifier and IP address (...)
  19. SpeedOf.me has a privacy policy that contains the following information about the use of an IP address:
    1. (...) To be able to provide services and decide about the necessity of improving the layout or content of our homepage, information about its visitors that we have collected in the access files, e.g. IP address, Internet provider, access timing, and the viewed sections is also processed (...)
    2. (...) TO CHANGE CONSENT OR RECEIVE INFORMATION ON DATA YOU MUST PROVIDE THE IP ADDRESS WITH THE DATE AND TIME THIS WEBSITE WAS ACCESSED. THIS IS THE ONLY WAY WE TRACK OR STORE INFORMATION AND WITHOUT THE ABOVE INFORMATION WE CANNOT RETRIEVE RECORDS (...)
    3. (...) We automatically receive information from your web browser or mobile device. This information includes the name of the website from which you entered our Website, if any, as well as the name of the website to which you're headed when you leave our website. This information also includes the IP address of your computer/proxy server that you use to access the Internet, your Internet Website provider name, web browser type, type of mobile device, and computer operating system. We use all of this information to analyze trends among our Users to help improve our Website (...)
  20. SpeedSmart has a privacy policy that contains the following information about the use of an IP address:
    1. (...) Sharing to many social networks is easy on SpeedSmart.net and to protect your privacy no personal information such as IP address and Location is included with any result shared though a image or publicly view-able web page (...)
  21. TestMy.net has a privacy policy that contains the following information about the use of an IP address:
    1. (...) Log files are maintained and analyzed of all requests for files on this website's web servers. Log files do not capture personal information but do capture the user's IP address, which is automatically recognized by our web servers. (...)
  22. Which Broadband Speed Test has a privacy notice that contains the following information about the use of an IP address:
    1. (...) Information collected automatically using cookies or other tracking technologies includes your IP address. If you have logged in, this includes your login details (...)
    2. (...) We collect, store and use the following types of information: (...) information about your computer / mobile device, for example your IP address (...)
  23. Xfinity xFi Speed Test has a privacy policy that contains the following information about the use of an IP address:
    1. (...) To provide you with our Services, we collect your personal information. This can include information that does not personally identify you - such as device numbers, IP addresses, and account numbers (...)
 

Conclusions

As mentioned in the introduction, an IP address is always specified when requesting a web page. The fact that this happens is reflected in most privacy policies.

Most privacy policies do not make it 100% clear what exactly happens to the IP address (a positive exception is Cloudflare). It is often indicated that the IP address may be used for analysis purposes.

Some privacy policies indicate that the IP address is used to determine location. Tools like Traceability at a Glance, WhatIsMyIP.com, WhatIsMyIPAddress.com and BrowserLeaks give an idea of what information (which location) is known based on your IP address.

Bottom line, it seems that the speed tests don't want to do anything with the IP address (although most privacy policies are written in such a way that one is legally protected). If you do not log in or complete a form with personal data when you want to take a speed test, the IP address will turn out to be a number that cannot be traced back to you.

The ideal log of an IP address

Ideally, the IP address is not logged, but instead a salted hash of the IP address (or a truncated IP address) and all information derived from the IP address is recorded for analysis.

Only Cloudflare states that the IP address is treated as suggested above.