from what i catched talking to our lawyer, there are other levels of consent than explicit by the user explicit consent that might be revoked, in this case.

1. concerns of security and quality of service (gathering logs with full ip addresses is allowed for a reasonable time, a few days for example).

2. you don't need to delete the logs if you use them for this specific purpose only.

3. for analytical purpose it is enough to use pseudonomic identifiers, in case of ip address zero out the last part and you are fine.

4. using Piwik or your own cookies? Suddenly its not a third party cookie anymore and you are more free to do things.

The problems for operators begin when they are handing this over to a third party.