[tupilaq]

Well, that (IP address and specific ID) probably constitutes information from which the identity of a natural living person can be discerned and therefore does fall under the protections of GDPR.

However, that by itself doesn't mean you can't collect it, just that you need to have specifically asked for their informed consent and not hidden this purpose away in a changelog.