Are you going to purge all your logs of IP addresses, since those are considered personal information too? Also if your website is ad supported in any way, are

Are you going to purge all your logs of IP addresses, since those are considered personal information too? Also if your website is ad supported in any way, are you sure they are in compliance, or will you get nailed because your ad provider wasn't completely compliant? https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs "All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website). If you don’t have a legitimate need to store these logs you should disable logging in your web server. You’re not even allowed to store this type of information without having obtained direct consent for the purposes you intend to store the information" Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense.