the part where you are not allowed to profile the user based on a piece of information for which it is impossible to obtain consent (IP address).
The law does not mention privacy, correct, but its entire rationale is based on the idea of privacy rights.