"personally identifiable" is a tricky thing. Even if you cannot use the data to identify a person, maybe your ISP or the police could, making the information "

"personally identifiable" is a tricky thing. Even if you cannot use the data to identify a person, maybe your ISP or the police could, making the information "personally identifiable". According to https://www.groundlabs.com/what-is-pii-for-gdpr/ https://www.groundlabs.com/what-is-pii-for-gdpr/ IP addresses count as PII. > Some requests totally are identify-able though, for example if the user goes on to click one of our ads, buy something, and give us their postal address. And if you operate at scale, that might happen thousands of times per day. IMHO this is a serious GDPR infringement. Do you notify users that you process PII, even if you don't bind on this request? Do you give users the option to opt-out before you do? If not, you are in serious trouble.