IP addresses are identified as personal data in GDPR. They're not exposed in the frontend, but HN might use them e.g. for logging.

Also things like deletion, takeout and consent/opt-out need to be supported (provided that HN falls under GDPR).