[davorak]

That is playing dice while dealing with potentially personal information though right?

It depends on Bob using DHCP, that his DHCP switches often enough, and there are enough people on the same network that the link can not be made.

The above is not always true, other mitigating factors are not always true. Which seems to make some of IP logs personal information. Or at least you are safest if you treat it that way.

I am basing some of my reasoning off an article that I was pointed to earlier: https://www.whitecase.com/publications/alert/court-confirms-...

Where, to my understanding, IP address are considered personal information only if you can link it to some other identifying info.

I think a regulator is unlikely to go after a company for not deleting IP logs in the current climate. As far as I can tell GDPR gives them the power to however.

Until there is some case/enforcement history it is understandable if people are cautious.