# GDPR Compliance FAQ

- Link: https://www.limitloginattempts.com/blogs/guides/gdpr-qa/
- Published: 2021-05-05T11:49:43+00:00
- Author: Greg Fisher

The free and paid versions of Limit Login Attempts Reloaded adheres to [GDPR standards](https://gdpr-info.eu/).
Compliance is ensured through the display of a security message on the login screen(
seen below).

![GDPR compliance for limit login attempts reloaded plugin. ](https://www.limitloginattempts.
com/wp-content/uploads/2023/12/image-13.png)

This message’s visibility can be easily toggled on or off via the plugin’s **Settings**
page. You may also edit the message and utilize shortcodes to link directly to your**
privacy policy** page.

![GDPR settings and messages inside the limit login attempts reloaded plugin. ](
https://www.limitloginattempts.com/wp-content/uploads/2023/12/image-14.png)

## Frequently Asked Questions

**1. _Doesn’t GDPR require an explicit consent of the subject for collection or 
storage of personal data (including IP addresses that are considered personal data
by GDPR)?_

No, it doesn’t. **GDPR does not make consent a mandatory requirement for all processing
of personal data.** Consent ([Article 6 (1)a](https://gdpr-info.eu/art-6-gdpr/))
is indeed one of conditions that can be used to comply with the GDPR requirement
that processing must be lawful, but it is not the only condition available to the
controller to ensure lawful processing – there are alternatives (before the list
of conditions it says that “at least one of the following” must be satisfied).
All
the conditions for lawfulness of processing are spelled out in **Article 6 of the
GDPR**. One of alternatives is **Article 6 (1)f**. It says it is legal to process
personal data if processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests are overridden
by the interests or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a child.Logging
IP addresses for the purpose of security is an extremely widespread practice. It
is a legitimate interest to comply with standard security practices. It is the default,
and most (all?) web-sites do this.I.e. it is legal to do this without a consent.

**2. _Do you save any IPs of people who try to access my customers’ sites or install
any cookies? Do you transfer it to some server?_

**Yes, we save IPs locally in the free version and send them to our cloud in the
paid version.** We don’t install any cookies, except for the three in the dashboard“
llar_enable_notify_notice_shown”, “llar_review_notice_shown” and “llar_menu_alert_icon_shown”.
This fixes AJAX-related issues for some customers with misconfigured sites. Those
cookies don’t track anything. 

**3. _Can you provide me with a privacy or terms page to link in my privacy policy
to be GDPR compliance?_

**You just need to turn on the GDPR message. This should be enough**. If not, you
can copy the explanation above and paste it into your policy directly. Here’s the
link to our [GDPR policy](https://www.limitloginattempts.com/gdpr-compliance-and-policy/).

**4. _If I use the free plugins the IP data will only reside in the site’s database?_

**Yes, the free plugin IP data will only reside in the sites database. **

**5. _LLAR used to have IP obfuscation, why did you remove it?_

IP obfuscation was removed **because a message is enough to be GDPR compliant**.
The obfuscation feature involves a lot of maintenance and is incompatible with our
cloud service.