That's what consent is for. GDPR allows tracking with user consent (letter a) of article 6). No need to enumerate all the purposes in the law. The problem is that the GDPR allows companies to use hide tracking behind the concept of legitimate interest, and behind 1 million checkboxes that users now have to click in order to opt-out of tracking.