In reply to Heather Burns.

@Heather, what you say, which should be obvious to anyone that is not ten years old is that the world is not black and white and things like GDPR need time to mature to identify and maybe even reduce the gray areas.

For me at this stage it is more in the state of mind than concrete actions. Do you gather personal information that you do not actually need just because it easy (as @otto hinted above) or do you ask yourself first if the information is actually useful in other ways than tracking users, and only then thinking about the legal aspects.

Comments is great example of where wordpress collects information because it is easy and no more. Right now the name can be spoofed, the email can be spoofed and even the IP address can be spoofed, or if you behind things like cloudflare it is useless info. So why do you collect that IP address information in the first place? so if some bad guy will do some bad things you will be able to track him down? if he is not dumb it is unlikely to happen, and meanwhile you have the personal information of bystanders just ready to be picked by anyone who can get to it.