GA4 has "IP Anonymisation" enabled by default. The setting truncates the IP before storing it. What it does not do is prevent the full IP from reaching Google's servers in the first place.

What GA4 actually does with IP

1. Receives the IP.
2. Resolves geolocation.
3. Truncates the IP.
4. Stores only the truncated version.

Step 1 is where the data leaves your control. For strict GDPR interpretations, that step is itself a transfer of personal data.

Server-side redaction

const ip = getRequestHeader('x-forwarded-for') || '';
return ip.split('.').slice(0, 3).join('.') + '.0';

In the GA4 client config, "Override client IP" references this variable. GA4 receives the truncated IP from the start.

What you lose

City-level geo accuracy. Country and region resolve correctly from a /24 network.

Apply the same pattern across destinations. The general anonymisation patterns apply.