you dont need to get the original ip back, just need to know how many unique ips are there, so sha(ip) is good enough
From a stackoverflow post from 12 years ago:
> I know I do 622 million SHA-256's per sec on a Radeon HD5830.
Which would take around 6 seconds to brute force a 32bit address space.
But this is aside the point, as the spirit of the law only allows "processing for legitimate interests". The use of technology, cookies or on the server is irrelevant. If thread OP has evaluated their collection[0] as legitimate, they can use whatever technology within guidelines. Otherwise, even a cookie less data collection would require consent.
[0]: https://ico.org.uk/for-organisations/guide-to-data-protectio...
Alternatively, you could use a new salt every day, which would only allow you to track an individual for a 24 hour period (likely enough for many).