Do you have website visitors in Europe or California? If so, you better be documenting what you're doing with those IPs much clearer than "might help finding of

Do you have website visitors in Europe or California? If so, you better be documenting what you're doing with those IPs much clearer than "might help finding offenders". Under Europe's GDPR, IP addresses are explicitly classified as personally identifiable information, and must not be recorded except for clearly identified and documented valid purposes that you communicate to your visitors and regularly review: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/purpose-limitation/ https://ico.org.uk/for-organisations/guide-to-data-protectio... California's CCPA currently doesn't apply to smaller companies, but imposes similar requirements: https://secureprivacy.ai/what-is-ccpa-and-how-to-become-compliant/#websitecompliance https://secureprivacy.ai/what-is-ccpa-and-how-to-become-comp... Security is explicitly a valid purpose, but I doubt "might help finding offenders" is clear and specific enough to be compliant. I'm not a lawyer, but ethically, you need to explain to your visitors how long you're storing IPs for, what you do with them and what you promise not to do with them, who you share them with, why you need raw IPs and not just salted hashes, etc.