We ban accounts that post like this. Please post civilly and substantively, or not at all.

https://news.ycombinator.com/newsguidelines.html

You might want to actually read the GDPR. IP addresses are PII.

Are you disputing that GDPR disallows you from retaining visitor IPs, especially without explicit consent?

Yes. It's fine to retain IP addresses for a reasonable amount of time if you have a good reason to keep them, such as security. Just rotate them as usual, and don't keep them longer than you need.

Consent is one basis for gathering personal information. It's only one, there are five others. Consent isn't always needed.

The fine for this would not be €20m either.