Yes, and also cookie IDs. Both are called out as examples in recital 30:
“Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.”
That particular guidance has provided a lot of gnashing of teeth because some readings of it have an implicit “because” before the final sentence. That is IP addresses are personal data as sometimes they uniquely identify people.
The guidance my firm received was to treat them, by themselves, as an ID. YMMV.
I think the easy way to check is to ask yourself if the data can directly link to someone's IRL identity.
If no, ask yourself if the police could identify them if they demanded and got the data.
If still no, ask yourself if the data is of a protected category (gender, religion, sexuality, etc.).
If you need any of this data, minimize your need first (ie this means storing IPs only for a limited timespan, german authorities have IIRC recommended 7 days as normal).
If you can't reduce your need, find another way to do what you do that has less need.
If all else fails, cover under legitimate interest and hope you're not Adtech.
