IP adresses being protected as personal data has an interesting side effect. You can't be compliant under both EU GDPR and Turkish internet security laws (proba

IP adresses being protected as personal data has an interesting side effect. You can't be compliant under both EU GDPR and Turkish internet security laws (probably shared by a lot of oppressive and semi-oppressive regimes). That law states you have to keep the poster IP address of every post on the site and turn them over on court order. Obviously, as with every law in Turkey, the enforcement is very subjective (for example, Twitter does not respond to most requests and nothing goes wrong for them. But say, if you're a non-Twitter scale website, you deny a couple requests or probably only one and you're getting blocked), and you might be able to get away with the "we don't store them/store them anonymized because GDPR" defence once. Yes there' a 'justice' loophole in GDPR but I don't think "we're still saving the IP addresses anyway in case a court requests it" argument would fly. In the end, to be perfectly legal in both jurisdictions, you'll probably need to differentiate based on IP address ranges or something.