Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics?
It makes sense to not store if you're running some kind of privacy service.
It makes sense to not store if you're running some kind of privacy service.
Same goes for credit card numbers, as an aside, I saw a credit card number being hashed in an app I was consulting on once... don't do that. Rainbow tables are stupid simple on inputs that small.
Everyone who's mindful of site visitor's privacy.
> How are you supposed to handle abuse or performance issues a visitor might have?
How does a static website handle those issues?
... you've developed a warped default of what a website is.
> Or perform analytics?
You can base your analytics on voluntarily provided information from users. Or just, like, _not_ do them.
There is such a thing as "legitimate interests" in the GDPR. Storing certain IPs specifically as a measure against spammers and botnets should be fine, as long as that's really all you do with the data.
> Or perform analytics?
This is the heart of why the GDPR exists. You are not allowed to collect and analyse personal data about your users without a legitimate reason or their consent (a legitimate reason is not "it pays our bills"). Either ask the user for permission or only store aggregated data.
Most companies just store a ton of data about users without having any clue what to with it, "just in case". If you collect data for specific purposes, you don't need it to necessarily include any personal info ("how many users clicked the red button instead of the blue one" doesn't require any PII, for example).