diff --git a/gdpr/protect_device_id.go b/gdpr/protect_device_id.go
index 7ce743b..20a9d7d 100644
--- a/gdpr/protect_device_id.go
+++ b/gdpr/protect_device_id.go
@@ -14,12 +14,14 @@ func ProtectDeviceID(val string) string {
 	l := len(r)
 
 	// If someone passes string with less than 2 characters, we don't protect it.
+	c := 2
 	if l < 2 {
-		return val
+		c = l
 	}
 
-	r[l-1] = hiddenRune
-	r[l-2] = hiddenRune
+	for i := 1; i <= c; i++ {
+		r[l-i] = hiddenRune
+	}
 
 	return string(r)
 }
diff --git a/gdpr/protect_device_id_test.go b/gdpr/protect_device_id_test.go
index 8b1cc14..9cdd40f 100644
--- a/gdpr/protect_device_id_test.go
+++ b/gdpr/protect_device_id_test.go
@@ -36,7 +36,7 @@ func Test_ProtectDeviceID(t *testing.T) {
 		{
 			name:  "string with less than 2 chars",
 			value: "1",
-			want:  "1",
+			want:  "*",
 		},
 	}
 	for _, tt := range tests {