I believe it is generally untested in law whether third-party Analytics count as "legitimate interest" (direct consent not required) in EU GDPR, which is why cookie banners talk a lot about "legitimate interest" now.