What are the potential legal implications of storing IP addresses in PHP applications without proper masking or encryption?

Storing IP addresses in PHP applications without proper masking or encryption can potentially violate privacy laws or regulations, as IP addresses can be considered personally identifiable information. To mitigate this risk, IP addresses should be masked or encrypted before storage to protect user privacy.

// Masking IP address before storing
$ip = '192.168.1.1';
$masked_ip = preg_replace('/\d+$/', 'xxx', $ip);
echo $masked_ip;