[x0x0]

personal data in the GDPR has a very expansive definition, and definitely includes things like IP. Processing likewise has an expansive definition, including collection and recording. Lots of sites will be processing and storing this data for internal analytics.

[guitarbill]

> Lots of sites will be processing and storing this data for internal analytics.

Just because you can doesn't mean you should. And not asking that questions has got us where we are today.

[yetanother1980]

Did your customers consent to what is effectively someone following them round the store with a clipboard?

[bjl]

So just don't do internal analytics. Or, if you feel you must, ask consent first. Easy peasy.