[robbiemitchell]

I disagree that it's this cut and dry. Unless you are stuffing PII into the GA cookie, there's nothing personal there and therefore it doesn't require consent -- at the least, you're not going to get in trouble for skipping it. Furthermore, even if an anonymous user did give consent, then requested a deletion, the company would be hard pressed to verify that person's identity in order to scrub the anonymous data.