It's not about what you release to the public, if you're processing this data in private it's still culpable. This page gives it some context: https://ico.org

It's not about what you release to the public, if you're processing this data in private it's still culpable. This page gives it some context: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Further down are the 6 reasons for processing. We know the first 5 don't apply: consent - there's no consent contract - it's not necessary to provide the Q&A answer site Legal obligation - there's no legal obligation Vital interests - nope Public task - nope So what it falls under is "Legitimate interests", SO want to use a user's IP address, process it to add company name, store that and then use that data for profiling their customers to serve them ads. One of the problems for SO is that further down they go into this a bit more and there's a few key questions: Would individuals expect this processing to take place? Are some of the individuals concerned likely to object? Are you able to stop the processing at any time on request? Which I would think would be answer No, Yes, No. Which seems to indicate that there's some problems with SO's approach.