>. You can get reasonably good statistics by just using a local log analyzer that does not upload your visitor's data to an analytics/ad company.

1) Has your user consented to your webserver's access logging?

2) Has your user consented to the use of access log entries about them for analytical purposes?

3) How will you delete the access log entries corresponding to a user upon request?

4) How will you provide a user with the access log entries about them upon request?

(I am not a lawyer, this is not legal advice).