Everything that can be used to uniquely identify a visitor falls under the GDPR. We don't store IP addresses, so it should be GDPR compliant, but we still need to check that to make the claim.