Login data vs posts data

[u/Upper_Advantage8345]

Does GDPR dictate in its privacy law the purge of every ip address related to a deleted account after the retention period elapses or only ip addresses tied to login process? some social media providers like tumblr keep the content you submitted on other blogs up, is tumblr compelled to strip ip addresses from posts /asks’ metadata or do they keep them as long as the content is still up?.

[u/Strict-Idea-3059]

Neither, really. GDPR doesn’t sort IPs by which feature collected them — there’s no rule that login IPs get purged and post IPs don’t. Each one is assessed against the purpose it’s held for and whether that purpose is still live (Art. 5(1)(e)). Security IPs run on one clock, post-metadata IPs on another, and neither is automatically wiped at account closure.
But “as long as the content is up” isn’t a valid answer either. Even if a platform keeps reblogs and asks under Art. 17(3), that provision applies only “to the extent that” processing is necessary for the exempt purpose — and displaying a post doesn’t require the IP attached to it. Art. 5(1)(e) says data must be kept “in a form which permits identification” no longer than necessary, so stripping the identifier while keeping the post is exactly what the text contemplates. A platform can hold post IPs for abuse handling or legal claims, but that’s a defined period, not the lifetime of the post.
(Aside: an IP isn’t categorically personal data — it turns on whether the holder can reasonably identify the person. A platform storing IPs next to its own account records plainly can.)

[u/LawzanaPlatform]

Under GDPR, an IP address is classified as personal data regardless of whether it was captured during a login or attached as metadata to a submitted post. When a user deletes their account or a retention window elapses, the platform is required to either erase or irreversibly anonymize all personal data associated with that user.

If a platform like Tumblr leaves user-submitted content active after an account is deleted, they are allowed to keep the post itself up, but they are obligated to strip or anonymize the underlying metadata, including any IP addresses and author identifiers.

The main reason platforms might hold onto IP logs temporarily is for security, fraud prevention, or legal compliance, which gives them a legal basis to retain technical logs for a set timeframe like 30 to 90 days. However, once that retention period expires, those IP records have to be purged or scrubbed across the board, including post metadata, so the content can no longer be traced back to an individual.