[Karunamon]

If accurate, the fact that you need a GDPR statement to cover the default logging configuration of every HTTP server created in the last 30 years strikes me as ridiculous. Wouldn't your own analytics/abuse prevention/optimization count as legitimate interest and not need a statement or consent?

I'm serious, the practical effect of what you described would be the internet equivalent of a California prop 65 warning that is on basically everything. I.e. meaningless. Everything in California causes cancer, everything on the internet has your IP address. And the "informed" person is not one bit better off as a result.

[dariosalvi78]

collecting IPs can be perfectly lawful without consent [0], if you justify it for security or performances, but you need to make sure to get rid of logs when they don't fulfil those purposes any longer.

[0] https://law.stackexchange.com/questions/28603/how-to-satisfy...