There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal

There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal consent, now that the privacy shield has been scrapped.