WHY IP ADDRESS TRUNCATION FAILS AT ANONYMIZATION

Summary from the TLDR newsletter

Truncated IP addresses are still personal data under GDPR, especially when combined with other information that most systems routinely collect. Subnet size doesn't correlate with user anonymity. The network prefix itself contains enough information for trivial identification. Many organizations are creating compliance risks by thinking IP truncation is GDPR-compliant anonymization. What is actually needed is encryption specifically designed for IP addresses.