Of course startups here - and everywhere else! - have to think about applicable law. Just like if you want to start a transportation company you'll have to think about applicable law. If a company does not collect any data at all then the GDPR is a complete no-brainer.

Try this and see if you can make it work for you: to identify an individual you need ~33 bits. An IP address, even though it doesn't quite get you there gives you a very large fraction of the number of bits required. Adding a few more makes the individual identified. So therefore it is a very good idea not to allow access to the IP address to unrelated parties from a privacy point of view.