Legitimate interest is one of the hardest parts to actually go for (I wouldn't use it for anything that is not seen by naked eye from the Moon) and you can argu

Legitimate interest is one of the hardest parts to actually go for (I wouldn't use it for anything that is not seen by naked eye from the Moon) and you can argue that analytics improves the "user expierience" while on the other side the user will argue, that it is not necessary for the site functionality to work. And it isn't. And this is the fundamental condition for legitimate interest. So the "expensive" lawyers are wrong but I think they are just trying to push the limits to see how far they will be able to go. Something about legitimate interest: https://youtu.be/-stjktAu-7k?t=4563 https://youtu.be/-stjktAu-7k?t=4563 Let me just point to one sentence: "Processing conducted due to "faulty" balance test (your interest vs. person fundamental human rights) may expose the controller (you) to highest level of fines". I wouldn't gamble here and go for local analytics (again piwik is simple to install and use) or require consent from the user. ePrivacy is not here yet, GDPR is and I doubt the analytics will be excluded as it is tracking in its purest form and you can set up your own software, no need for 3rd party processor here. It would literally destroy the GDPR principles which I doubt ICOs will allow. For my (user) perspective: I don't have problems giving consent to particular site if they don't give the data to any 3d party processor, from google, fb, amazon to various ad networks. Bottom line, the problem is not for various sites to have my PII, but I have huge problem with agregating those data by single entity and I will never give consent for that (read as: google analytics).