[tripzilch]

> I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts.

I believe they must also show that they don't store this data strictly longer than necessary.

Which, in the case of analytics/usability would mean aggregating (and thus depersonalising) the data almost immediately.

And if they do that, it will indeed be fine. Both with the letter, as the spirit of the law.