Your examples are both bad. IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data

Your examples are both bad. IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security. Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.