> But I doubt that law has actually resulted in companies spending significant additional staff time minimizing logs they didn't really mean to be keeping int t

> But I doubt that law has actually resulted in companies spending significant additional staff time minimizing logs they didn't really mean to be keeping int the first place. It is not a trivial operation. This is Germany – the place where the requirement for websites to contain a working contact address in the real world is enforced not through law, but through people just suing every website owner whose site doesn’t have an imprint. The ISP is only keeping as much as absolutely necessary, because every bit more would be an unnecessary legal liability. Personal data is a liability, not an asset. Of course, there’s also companies with different viewpoints, but this one doesn’t keep any more than absolutely necessary.