[nmjohn]

> Still, using ip addresses to try to determine where a request is originating from is not a good idea

How else should they do it? I concede it is not foolproof nor ideal - but for websites which you've not provided your location to yourself, how is it possible for them to determine whether or not you are in Europe?

[dogma1138]

You are allowed to use it and even keep it without consent if anything the GDPR wants to separate consent from data processing. https://eugdprcompliant.com/personal-data/

You can maintain the records of an IP address (as well as other PII) for business needs e.g. security or to enforce other requirements such as geoblocking even without explicit consent of the user it's all about why you and what do you with it which is why legal/lawful grounds exist.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Also for the most part if you do not have a lawful basis for collecting or processing PII consent is not a sufficient reason to so.