vladimir_prus

I would not be so sure. Avis, in particular, is actively pushing for a flow where you book online, use "secret" promo code to get full insurance for basically zero, pick up car directly on parking lot with keys inside, and drive away. It takes literally 5 minutes and a single employee to check your driving license and contract. Hertz is trying to do same, though less effectively. Their websites and apps are still horrible, and it's perplexing why, but the cost of building decent apps will be immaterial compared to the cost of the vehicles, and from that, building actual on-demand short-term rental network does not seem so unlikely.

GDPR fundamentally cannot tell whether storing of IP addresses is OK - because it's the processing of personal data for a specific purpose that can be lawful or not, and there's infinite number of possible processing purposes.

For example, if you're a CDN business, and naturally need to fight DDOS attacks, then storing exact IP addresses for all requests for a few weeks easily falls under "legitimate interest" (GDPR 6.1.f). On the other hand, if you're a political news site, then storing IP addresses and URL for the purpose of determining political preferences of people without their consent is very clearly illegal, taking into account that IP address can often be static and so identify specific person.

Yes, it means that you have some decisions to do yourself, and the regulator might disagree with your decisions, but that's true about pretty much every new law, no?