How far does this go, though? For example, on my silly little blog, I've got logging for each http request that records the url hit, the ip address, and a brow

How far does this go, though? For example, on my silly little blog, I've got logging for each http request that records the url hit, the ip address, and a browser user agent. I can trace that session through, and have a pretty good fingerprint of that user from that alone. If that person goes and sends me an email or leaves a comment with some tidbit of information that correlates (name, where they are from, email, what post they were reading, etc), have I now accidentally collected enough information that it violates GPDR?