GDPR requires a lawful basis for collecting and processing PII and one of possible lawful interest is "legitimate interests" that reasonable anti-spam/bot syste

GDPR requires a lawful basis for collecting and processing PII and one of possible lawful interest is "legitimate interests" that reasonable anti-spam/bot systems would fall under, i.e. ones that don't needlessly store the IP forever and don't use it for other purposes than security.