> iP addresses are within scope of GDPR, period. This sentence does not mean anything. The actual position regarding IP addresses as personal data is that "an

> iP addresses are within scope of GDPR, period. This sentence does not mean anything. The actual position regarding IP addresses as personal data is that "an IP address may be personal data if you are able to access additional information which enable you to identify the user behind the IP address", hence my previous statement. Unfortunately, this is often oversimplified (as tends to happen to any non-trivial issue) to "an IP address is personal data". It does mean, though, that one must be careful when handling IP addresses and may treat them as personal data by default as a belt and braces approach (as I already mentioned in my first comment), but that's not the same thing.