[cccbbbaaa]

> So in essence, it disallows logging IP address for any purpose, be it security, debugging, rate-limiting etc. because you can't give consent in advance for this, and no other sentence in Art. 6.1 applies.

In addition to the other answers, I want to point out that recital 49 says that it is possible under legitimate interest (6(1)f).

[cmenge]

Thank you! This is the only non-vague answer, as it directly addresses the use-case.

If only I had known this in my last corporate role where this discussion alone cost us weeks :/