It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data.
Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer.
As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data.
The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data":
It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are protected personal data because they allow those users to be precisely identified. (my emphasis)
Then, in 2016, the ECJ ruled in a more narrow case ECJ C‑582/14 specifically ruling on dynamic IP-addresses:
The court goes through a number of deliberations, then concludes:
Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.
It is very clear from this text that the court does not challenge or invalidate ECJ C-70/10 on static IP-addresses. The court is very careful, in its ruling to point out its ruling is specifically about dynamic IP-addresses.
So the ruling of ECJ C-70/10 still stands for static IP-addresses, these are always protected personal data.
I believe this case law is summarized in Recital 30 of the GDPR. This recital lists the identifiers that may make natural persons identifiable:
Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).
Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable, I will conclude, based on jurisprudence alone, that:
Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR.
However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong.
In 2015, the Norwegian computer scientist Einar Otto Stangvik
identified 78 Norwegians who seem to have downloaded abuse material
starting only with their IP-addresses.
Stangvik did this while working as a consultant for Norway's larges newspaper VG.
I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to.
I will not go into details, I will just say this: If you know how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming.
To return to the question: It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing".
Answer: It depends.
What it depends on is whether you have access to those logs and whether you practically could identify the real persons to which the log entries belong to — without employing detectives and using forensic science.
Two opposite examples would be:
- Your website does not allow any input from users. They still leave log entries with their IP addresses, but you have no practicable means to find out the real persons behind those addresses. And even though, in theory, intelligent services could investigate and track the persons down, this does not make the log entries personal data.
Art. 4 defines "personal data" as "any information relating to an identified or identifiable natural person". Do IP addresses relate to identifiable persons? They may (as in example 1) and they may not (as in example 2).
Drilling further down, GDPR specifically mentions "internet protocol addresses" as data that persons "may be associated with", which, again, implies that it depends.
GDPR also explains that the costs and time required for identification can be the line dividing personal and anonymous data:
To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
— which relates to example 2 above where one would need to spend substantial money/time to identify anonymous website visitors by their log entries only.
It should also be noted that GDPR is a new law which has not yet had any cases decided on it. Somewhat relevant cases mentioned by Free Radical (ECJ C-70/10, ECJ C‑582/14) were decided based on laws/directives that GDPR supersedes. Therefore, those cases cannot be regarded as precedents that judges would necessarily follow when deciding cases on GDPR, but rather just relevant reference/guidance cases.
Another reason why judges would re-build their decisions from scratch rather than follow the above mentioned cases is that technology goes forward very rapidly. While in 2011 ECJ C-70/10 talked about "IP address" full stop, in 2016 ECJ C‑582/14 had to consider the difference between static and dynamic IP addresses, and specify conditions under which the latter can be personal data ("where ... has the legal means which enable it to identify the data subject").