Google's 'All-Seeing Eye' uses first-party cookies, just like anything you'd install on your own server. Just because something uses first-party cookies doesn't mean the data's not being sent to a third-party.

If this goofy law is more than sporadically enforced, future analytics probably won't use cookies at all - they'll just combine browser fingerprinting with server-side logs that get automatically sent to a third-party for processing. Individual end-users won't have any way of knowing whether it's there or not.