When using IP addresses, there are two EU laws to consider:
GDPR regulates the use of personal information, which includes online identifiers. IP addresses are likely to be personal data in this context. Processing personal data requires a legal basis, such as a legitimate interest or consent. When relying on consent you cannot reuse the data for a different purpose. You must be transparent about the processing of personal data, ideally using a layered information approach: the first layer summarizes information just before processing takes place, and a second layer provides the full privacy policy.
The ePrivacy directive instructs EU member states to implement certain laws regarding electronic communications. It introduces the concept of traffic data, which includes IP addresses. Traffic data can only be processed for the purpose of providing the service requested by the user, or when the data is anonymized, or when the user consents. Similarly, you can only access information on the user's device if it is strictly necessary for the service, or if the user consents.
Using the IP address for geolocation would e.g. be okay
- if the user requested this service (necessary under ePrivacy, legitimate interest under GDPR); or
- if the user consents to this use.
If you use third party services to perform the geolocation, they should be bound as your data processor, or you should only send anonymized data to the services (e.g. redacting some bytes of the address, or mixing with plausible but random addresses)
However, IP geolocation is extremely unreliable in Europe. Country-level location is generally fine, but city-level location rarely works – I'm often shown locations up to 200km away (this depends a lot on the ISP). Thus, it might be better to offer different approaches:
- show a map of the whole country to the user, and let them zoom in themselves
- use a search box where they can enter town names
- ask for the postcode and show nearby stores in that area
- for mobile devices: ask for consent to access GPS location
Postcode lookup can be performed entirely client side and would be one of the most privacy-preserving approaches.