> GDPR is not clear on IP address or IP address derived metadata. There is no case law for it,

There is, see C-582/14 which concludes that IP address, even dynamic, are personal data.