Q: Since users of Plausible are sending you their visitors IP addresses, doesn't that mean GDPR applies? GDPR mentions "disclosure by transmission" as an example of processing[0].

Since that's the case, doesn't that mean you need a legal basis for processing the data[1], you need a way to allow users to opt out of collection of their data[2], and your clients need to sign data protection agreements[3] with Plausible?

I tried looking for Plausible's point of view on this and how they address the above, but I couldn't find anything.

[0] https://gdpr-info.eu/art-4-gdpr/

[1] https://gdpr-info.eu/art-6-gdpr/

[2] https://gdpr-info.eu/art-21-gdpr/

[3] https://gdpr-info.eu/art-28-gdpr/