At GDPR presentation that I attended recently in Norway the message was that IP addresses must be masked if they go to a permanent storage. For IPv4 it could be OK to clear the last byte of the address, but in general the message was to save the least amount of information. For example, if IP is used for locating regions, then save the regions, not the IP itself.