If I have statistics on users location data (i.e. city, country, etc.) aggregated from hundreds or thousands of users, are there any restrictions on storing and using these data under GDPR? I plan to store it in plain text and make it publicly available, with the users' consent of course. E.g. 1540 users from country X have an average statistics of Y. Of course if one user's data is deleted, it will still remain a part of the aggregate statistics. Will this be legal under GDPR?
You will need consent that is freely given, informed, unbundled and intelligible. This is a high burden. Without consent you will have to encrypt/anonymise personal data before you aggregate and run data analytics. If you rely on a de-identification or pseudomization method, you are not exempt from privacy law. As for deletion of user data, as long as you have anonymised the data prior to aggregation, it is okay under the GDPR - specifically the right of erasure. You wouldn't have to remove it from aggregate statistics because it isn't technically feasible.