Here's how we've done it. There's no legal precedent but we believe this makes us compliant:

To enhance the visitor privacy, we don’t actually store the raw visitor IP address in our database or logs. We run it through a one-way hash function to scramble the raw IP addresses and make them impossible to recover.

To further enhance privacy, we add the website domain to the IP hash.

We also add the User-Agent string to the hash.

We've shared more details on this here https://plausible.io/data-policy