Since there are legitimate use-cases where you need to be able to somehow identify requests coming from the same IP (protection against DDoS), you would be allo

Since there are legitimate use-cases where you need to be able to somehow identify requests coming from the same IP (protection against DDoS), you would be allowed to do it, given that you take reasonable steps to protect the user (such as deleting the logs after a few days when there's no suspicious activity). And then hashing the IP addresses would be such a reasonable step, too, since it removes location information from the stored data.