If your server logs contain personal information then you are doing something horribly wrong and I hope you don't operate in the EU.

Don't log sensitive data. You don't need that for debugging.

But this is the same problem!

The GDPR and such define PII so broadly that more or less everything in web server logs is included in the definition.

Not sensitive PII, but still PII that the individual has rights and interests over.

That is more or less on purpose, and they do have a point.

Rogue debugging on the other hand is not what they are worried about vs using the data in web logs for targeting, profiling, etc.

If you could sell your web logs, would you? Vs how much would someone pay reddit or github for theirs? And would you be ok with that if your browse history was in there?