This: Under GDPR, IP addresses can be considered PII,so it makes sense to set up an anonymizer is wrong. First of all, PII is a legal definition from mostly

This: Under GDPR, IP addresses can be considered PII,so it makes sense to set up an anonymizer is wrong. First of all, PII is a legal definition from mostly the US. The GDPR talks about Personal Data, which is different. If any consultant is talking about GDPR and PII, he is confused, stop listening. Have fun reading the details here: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ Which doesn't matter all that much, because the next part of the line is way to broad: Is an IP adres Personal Data? Maybe, if you can use it to track an individual. But if you arent an ISP and don't actively try to identify anybody with an IP, stop worrying. Next question: Do you need it? In general, using them for keeping the website running is normal usage.So no need for consent. Using them for attack prevention might actually be an industry best practice, and then the GDPR requires you to keep them. Next question: If you need them, how to keep them safe? Throw logs away after a while, encrypt backups, etc... The GDPR has been hijacked by consulting companies to extract money from everybody, so they do their utmost best to sow paranoia with all kinds of weird urban myths. DOn't believe it. Basically, do the normal IT best practices and stop worrying.