Right now I altered these values directly in the plugin, but that’s not really a good solution…
I’m open to adding these as configurable parameters. However, I’d like to learn more about why you’d want to change them before making any changes. The defaults have been really carefully selected to not need changing.
override the comment_author_IP to be used (I prefer to set the IP to 127.0.0.1)
You risk having a plugin block access from the loopback interface that way. This could cause all sorts of problems for you.
0 was chosen as it’s the default value in WordPress for an unspecified IP address, it resolves to 0.0.0.0 in most of PHP’s functions for handling IP addresses, and it’s the documented default return value for get_comment_author_IP().
perhaps even only anonymize the existing IP by deleting one or two octets
Please provide a use case for a partial IP. Keep in mind that IPv4 depletion means IP assignments have become very granular, so you can’t tell much — if anything — from a partial IP these days. E.g. my current home IP address is located in Spain according to GeoIP databases, but I’m actually in Norway. —and that is with the full IP address. I can’t really see any use for a partial IP, so the plugin just gets rid of them at the end of the 60 day period.
set the maximum storage duration of the original IP address – 60 days seems a bit too much to be really compliant with DGPR
This isn’t legal advise. I’m not a lawyer. You’re allowed/have a legitimate purpose for storing IP addresses under the GDPR for the purpose of detecting and preventing fraud, and for network and operational security. It can take days or a weeks before an IP is recognized as an aggressive spammer, and a spam-fighting plugin can retroactively act and remove comments submitted by the IP in question. Likewise, a comment moderator can spot the same IP posting many comments under different names but from the same IP. You really have a legitimate interest in storing the IP for a year or two!
Two months was chosen after reviewing literally hundreds of privacy policies and finding that of those who specifically mentioned comment IP removal, they did so after two or three months. E.g. “We store the IP addresses along with any submitted comments for two months to prevent spam, fraud, and abuse.” Anti-spam plugins seem to be capped at retroactively deleting things after 4–6 weeks. 60 days seemed to fit well with the ecosystem and with how other websites already handle this.
