More generally: analytics mustn’t rely on storing anything on the user’s device for its functionality; that’s why people head in the direction of fingerprinting.
https://ec.europa.eu/justice/article-29/documentation/opinio...
The WP29 is superseded by the European Data Protection Board and there seem to be proposals for an updated ePrivacy Regulation making their way through the system. Signals are mixed. The proposal by the commission from 2017 mentions the usefulness of analytics cookies as a possible exemption. The EDPB on the other hand gives the opinion that a future ePrivacy Regulation should not lower the level of protection offered by the current ePrivacy Directive and looks not kindly on possible exemptions, but describes an exemption for an audience measurement as “very limited privacy risk for the users”.
Interesting. Maybe there is a possibility in the future.
https://digital-strategy.ec.europa.eu/en/library/proposal-re...
https://edpb.europa.eu/sites/default/files/files/file1/edpb_...
What should matter is what’s logged. Every request contains an IP that’s how the web works.