You can do a lot of analytics without touching personal data. Page view counts, countries people visit from (assuming it's low enough granularity (not personall

You can do a lot of analytics without touching personal data. Page view counts, countries people visit from (assuming it's low enough granularity (not personally identifiable) and you don't use a third party service), times people visit. All the juicy stuff, really. You can use third-party resources if you self host them (like fonts, images, videos, ...). Not sure about CDNs, but I don't think a global CDN that's GDPR compliant can exist.