In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients.
We track user interactions with our site in order to monitor usage and engagement.
Under GDPR, it looks like we should be asking for separate consent for this monitoring, since it is not required to use the service itself. Is this correct? If we write such requirements for consent into our contracts with our clients is this sufficient or do we need to obtain it on an individual basis, e.g. after first login? Obviously we would still provide the ability to opt-out of this tracking via a user's profile.
I guess it boils down to whether we are a controller or a processor for these data. Since only the controller needs to obtain consent, if we are just a processor that makes our life considerably easier.