Google has been working on making Google Analytics GDPR compliant, but you must actively change some settings to pseudonymize collected data and also sign/accept a GDPR contract with them. Also you must make sure to not explicitly add any personal data to GA. For example avoid sending any user names, email addresses, ip addresses, or any form data to Google Analytics as part of event data.

I don't have an overview of all steps required but provided you do this then GA should still be allowed to be used without explicit user permission.

A very good question which I don't know the answer. But what I do know is that since IP addresses are considered personal information, then you can tell the GA script to anonymise it.

https://support.google.com/analytics/answer/2763052?hl=en

Of course, that doesn't stop that IP address becoming aware to the GA servers, but they should stop it being used further down the line.

I suspect it's similar to using a CDN where the IP address again is passed to a third party.

This is true, but you also must engage in a GDPR contract with Google Analytics. I believe they have recently added this as a feature somewhere.

I researched this and didn't find a conclusive answer yet. What I found out is:

The original plan was for both the GDPR and the ePrivacy Regulation [1] (not to be confused with the ePrivacy Direcive) to come into effect on 25 May 2018. The ePrivacy Regulation would have had a special exemption for analytics cookies. If that would have been enough to not require consent for Google Analytics I do not know.

Now the ePrivacy Regulation is delayed but the GDPR is not. I didn't find a lot of information about what that means for the time after 25 May 2018. The following is from German sources (primarily e-recht24.de [2]) and is only from a German perspective.

Google's terms [3] in accordance with German law currently require consent in the case of AdSense but not for Google Analytics. According to [2] this is in obvious conflict with current EU law but the EU Commission denies that.

e-recht24.de [2] is careful to avoid a clear statement about the situation after 25 May but from my understanding they hint that the situation will not change. German law is already in conflict with EU law and this fact is ignored by all parties. The GDPR will not change that situation.

[1] https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

[2] https://www.e-recht24.de/artikel/datenschutz/8451-hinweispfl...

[3] https://www.google.com/about/company/user-consent-policy.htm...

As far as I've researched, no. GDPR is open to the sorts of tracking that is used to make your product better. In the case of google analytics, you're watching for aspects of your product or blog that are doing well so you can produce more of the content viewers like.

One of the caveats though, is that you shouldn't be able to identify a specific user. So, you would need to anonymize the IP addresses you're tracking [1]. My understanding is that you should not be tracking or storing information that can be used to identify a single user. So cookies are ok, but you have to ask permission for any cookie that can be used to personally identify a user.

[1] https://developers.google.com/analytics/devguides/collection...

Ask yourself this simple question (per my other comment). If the answer is 'yes' (and I am not saying it is btw) if 'every site' (your site) didn't what do you think will happen? (Vs. what could happen).

Yes, and if the user refuses to give that permission, the site has to honor that, and can’t refuse to provide its content. Same as the original cookie law, which almost everyone did wrong (thanks to the UK national implementation of it)