General Data Protection Regulation (GDPR) is coming into force on 25 May 2018 and forcing organisations to review the ways they collect and manage personally identifiable data of EU citizens.
Under the GDPR, if you use Google Analytics for your website, then Google is your Data Processor and your organization is the Data Controller since you control which data is sent to Google Analytics.
So you need to turn on IP Anonymization in Google Tag Manager, because Google does use it to provide geo-location data.
Please follow this step below for turn on IP Anonymization in Google Tag Manager
To check if the IP Anonymization field is set correctly you follow this step below