zlacker

> You cannot store a users personal data like IP or cookie id unless you have consent from the user.

This isn't true; there's a list of reasons you can keep information and "with consent" is one of them, "legitimate business need" another: https://ico.org.uk/for-organisations/guide-to-the-general-da...

But: "However, an individual always has the right to object to processing for the purposes of direct marketing, whatever lawful basis applies."

So: you can store IP addresses as part of your information security needs, but not turn round and use them for direct marketing. (I'm not sure if web advertising counts as "direct marketing" here)