That quote is incoherent. Your quote -- clause 1 from A22 -- indeed points out that profiling is permitted under circumstances enumerated at the end. Further,

That quote is incoherent. Your quote -- clause 1 from A22 -- indeed points out that profiling is permitted under circumstances enumerated at the end. Further, the GDPR has rules around two things you mention, but they are different: (1) profiling; (2) automated decision making. Profiling has three elements, as described by the A29 WG: * An automated form of processing. * Carried out on personal data. * For the objective of evaluating personal aspects about a natural person. As for IP addresses, mapping them to an ASN is fully anonymized. Since an anonymized IP address is not personal data, using it is not profiling. Blocking users from using your site is highly unlikely to have the "legal effects" enumerated in the above clause.