Speculation here, but informed speculation: I highly doubt you as a non shady actor will be punished because of your server logs as such. Start selling or oth

Speculation here, but informed speculation: I highly doubt you as a non shady actor will be punished because of your server logs as such. Start selling or otherwise sharing them with ad companies, directly or indirectly and you deserve and should expect a GDPR fine as soon as they can if you are in a jurisdiction where GDPR applies. Same if you involuntary leak data because of gross negligence: passwords in cleartext, unnecessary data collected and stored and later leaked etc etc In many cases I understand authorities will even contact companies first and try to guide them toward a compliant solution first instead of fining tjem right away. That said I wish there were some clarifications given wrt to server logs and IP addresses; running without is in many cases gross negligence in itself. Basic logging is first year defense against black arts curriculum.