[allover]

As someone going through this right now, the main difficulty in being GDPR compliant with GA is the cookie problem.

You can either disable cookies to run GA in cookieless mode [1], which presumably will affect how GA performs, since they can't determine repeat visits (but this might be fine, depending on the type of site you have), or you need to gain active consent to enable analytics cookies [2], which isn't much good if you want metrics for all users, not just those that opt-ed in.

If someone has solved this reasonably, I'd love to hear how! For now it seems like cookieless is my only option.

[1] https://developers.google.com/analytics/devguides/collection... [2] https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...