I agree there's a lot of misinformation which leads to GDPR hysteria, however, unfortunately this is one such example of misinformation.

https://commission.europa.eu/law/law-topic/data-protection/r... clearly calls out IP addresses as the 6th bullet point underneath the heading 'Examples of Personal Data'.

Article 4 paragraph 1 says personal data can be any data which could be linked to an identifiable person. The 'indirectly' word does seem to imply that it does not necessarily have to be the processor or controller who can link that data to a person. Quote from the GDPR itself:

> 'personal data' means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier

This has been tested in courts. At least in Germany, it has been ruled that an IP address in and of itself is personal data because it can be associated with other records to determine who a user is (even though the 'online media services provider'—the server operator—does not immediately have access to this information).

https://curia.europa.eu/juris/document/document.jsf;jsession...

> The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46.

It is important to note though, that it is not unlawful to process personal data provided you have a privacy policy, etc. Maintaining server logs almost certainly is covered by legitimate interests, even though the IP addresses are personal data.

However, it is not enough just to say 'it's a minor preference, we can hand wave this away'. You must absolutely make sure that you are meeting your obligations under the GDPR, including having proper privacy impact assessments, technical and organisational controls on who can access this data, etc.

For this reason, the way it is currently implemented (end user does all 'processing' on their own computer) is best. However it's important to consider that even this may open up an organisation to some level of risk by inadvertently creating sets of circumstances which lead to the preference being detectable.

For example, if you have an image which is set to 'display:none' when dark mode is enabled, then it would be possible to infer, based on the server logs, that because the user loaded the page but their browser did not load the image, they are likely using dark mode. Obviously this isn't true for all browsers, behaviour does vary, but still.

The vast majority of GDPR hysteria is based on people not understanding that the majority of GDPR response should not be 'WE CAN'T DO XYZ OR WE GET A HUGE FINE', and instead 'we need to do a bit of paperwork to be allowed to do xyz'. For example, a dark mode toggle privacy impact assessment could include something along the lines of 'users have to actively choose this option', 'dark mode may be preferred by users with vision conditions, but we would not be able to interpret our data to determine which users (if any) have vision conditions', etc., and would probably be less than a hundred words of actual work (more with boilerplate, etc.).

But GDPR complacency is also a problem. Companies can (and do) get fined all the time for doing things they thought weren't a big deal. You can check the fines here: https://www.enforcementtracker.com