hi,
I think that the solution is to use “Crypt IP addresses” and you are CGPR compliant because there is no a decrypt function possible on collected data.
About getting clear IP address collected without consensus this is a open question as IP could be shared from users by his service data provider, so only fixed registered IP address correspond to one real user.
This means that you cannot implement easy a function that ask the user for consensus as data collected is by IP, not by a way to know him directly.
You could know a user if you set a persistent cookie into his computer or force him to register and login as WordPress user into your site.