How does this affect server logs? Under the "what is personal data" section they list ip addresses as personal data.
Edit: Also consider Log retention. Yahoo discovered a data breach 3 years after it happened. What if they'd only kept logs for 1 year.
It's useful to know where the requests come from too. You get a bunch of request from IP that come from a specific peer and that peer is saturated? How could you verify that without a log? You want to add CDN to the right locations. Where should you?
Really, I think it's just make more sense for any small company to block EU and when you have the means to do it correctly (with the help of a competent DPO), then yeah add that EU in your market.
Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en
Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.
Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location?
On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?
For example if hacker news did this and one of your comments contained your city or company, now they can connect your account to an anonymized analytics user.
And then hashing the IP addresses would be such a reasonable step, too, since it removes location information from the stored data.