If you've found some, please share.
... It's not even clear that it's safe to log IP addresses in the style of a default Apache configuration on a static website without user consent.
It's completely predictable that there are people who don't want to comply. Collecting personal information is a lucrative business.
Re. Website logs: in fact it's perfectly clear that a website log retained for the purposes of site management is fine. It's on the face of the regulation.
Right, collection for the purpose of running the site and all that. But does that mean "I run my site without having ever configured apache's HTTP access logs off the default, but I never read the logs" is fine? Because that sounds like collecting more PII (in the form of stored IP addresses) than is strictly needed to run the site. https://law.stackexchange.com/questions/42438/do-default-apa...
... and that's the problem and the reason that it's probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. Because the answer to that question is on the other side of a judge's ruling after a very expensive lawsuit. Better safe than sorry.
The law, as written, has entirely too many "The resolution of that ambiguity is on the other side of a judge's ruling after a very expensive lawsuit" for people to have not predicted a million banners. The defaults of the most ancient tools we use to host websites are, under the GDPR, ambiguously compliant.
Frankly, I don't think someone with that attitude should administer a server that's connected to the internet.
At least, every small blog and personal site that hasn't just given their content to one of the FAANGs already to do those jobs for them (which will, of course, "solve" these problems by throwing a cookie-consent banner and hooking the content up to their view-tracker of choice).
I disagree.
As far as I can see, GDPR enforcement is not heavy-handed. You get a warning before any attempt at enforcement; then you get a modest "warning" fine.
Also, I'm not aware that the silly cookie banners provide any protection against GDPR enforcement; it's how you handle the data that matters, not a two-liner banner offering [OK] [Later] buttons.
If you want to "be on the safe side", handling data correctly will help; cookie banners won't.
https://news.ycombinator.com/item?id=30402052
... and again, the problem is "correctly" is in the eye of a judge after an alleged violation has occurred.
Regarding Apache logs, a default install of logrotate will probably bring you into compliance (not sure, haven't looked into it lately). Scrubbing IP addresses from Apache logs defeats the purpose of the logs; you need to know what IP addresses are attacking your server.
To reach the stage of a modest fine, you will have to ignore that warning and advice, effectively saying "So fine me, regulator!" And if your violation isn't egregious, you'll be a long way down the list of forthcoming legal actions.
Basically, making a reasonable effort to understand GDPR and come into compliance is probably both a protection against action, and a defence against conviction.
It's not hard to comply with the GDPR, unless you are running a business that depends on violating GDPR.
IANAL.
My anger is directed towards the criminal websites that seek to circumvent the spirit of the law (most if the web today)