https://gdpr-info.eu/recitals/no-49/
> Network and Information Security as Overriding Legitimate Interest
> stopping ‘denial of service’ attacks
Storing logs with IPs is no problem at all.
> Network and Information Security as Overriding Legitimate Interest
> stopping ‘denial of service’ attacks
Storing logs with IPs is no problem at all.
For instance, you can use this stored IP address to help identify whether your user has had their account breached, and prompt for extra verification before letting them log in. You can also do a full browser fingerprint for this purpose, this is all covered under legitimate basis.
However, once you use any of this data to market to the user then you are in breach of the GDPR as you did not have a consent basis for it. The storage was never a problem, it's the use of it that becomes a problem.
Unless you are a huge company or have a significant amount of customers in the UK/EU it's probably okay to ignore the GDPR.
You have the right to log IP addresses only if they are used for the two purposes you listed, otherwise you will need explicit consent.