Not only is it GDPR compliant, but utilities and plugins like this can help site administrators to meet the expected standard for taking reasonable technical and human security measures against data breaches and security concerns. In the event of a system event or a regulatory query, documented evidence that you monitor what is happening on your own systems will greatly support your case. Think of data breaches like the Carphone Warehouse hack - 10 million people's data on a laughably duct-taped WP install - where the UK's data protection regulator ruled that not knowing who was using the site, when, and at what level of access, was no excuse for an internal breach which became external.

I see a lot of conflation of back-end system security, which does not require consent, with customer-facing data collection and behavioral monitoring, which does. People seem to think those two things are one and the same. They are not. Don't throw out the baby with the bathwater.

With this app, in any case, it merely shows you the information you would be seeing in a desktop WP dashboard anyway. The IP address of a commenter, while personal data, is an essential aspect of security monitoring - one need only think of the previous story on this site to see scenarios where that is necessary such as trolling, harassment, and sock puppeting. In this week's core privacy group office hours, we discussed how long IP addresses of commenters should be retained in the database for technical and security purposes before being obfuscated. Anyone interested in this question, or other core privacy issues, is welcome to contribute.