Your question is partially answered in this other post: GDPR Compliance: Do all Cookies require Opt-In?
As mentioned there, WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194 interprets the two criteria for Cookie Consent Exemption:
(...) exempted from the requirement of informed consent, if they satisfy one of the following criteria:
CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic
CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the
subscriber or user to provide the service”.
It interprets these requirements deriving from Directive 2002/58/EC in relation to First party analytics in Section 4.3, as follows:
4.3 First party analytics
Analytics are statistical audience measuring tools for
websites, which often rely on cookies. These tools are notably
used by website owners to estimate the number of unique visitors, to
detect the most preeminent search engine keywords that lead to a
webpage or to track down website navigation issues. Analytics
tools available today use a number of different data
collection and analysis model s each of which present different
data protection risks. A first-party analytic system based on “first
party” cookies clearly presents different risks compared to a
third-party analytics system based on “third party” cookies. There are
also tools which use “first party” cookies with the analysis performed
by another party. This other party will be considered as a joint
controller or as a processor depending on whether it uses the data for
its own purposes or if it is prohibited to do so through technical or
While they are often considered as a “strictly necessary” tool for
website operators, they are not strictly necessary to provide
a functionality explicitly requested by the user (or
subscriber). In fact, the user can access all the
functionalities provided by the website when such cookies are
disabled. As a consequence, these cookies do not fall under
the exemption defined in CRITERION A or B.
However, the Working Party considers that first party
analytics cookies are not likely to create a privacy risk when
they are strictly limited to first party aggregated statistical
purposes and when they are used by websites that already
provide clear information about these cookies in their privacy
policy as well as adequate privacy safeguards. Such safeguards
are expected to include a user friendly mechanism to opt-out
from any data collection and comprehensive anonymization
mechanisms that are applied to other collected identifiable
information such as IP addresses.
Provided the data you collect is effectively aggregated, and that you do not keep the IP address or another way to directly or indirectly identify the user, it seems that you would meet the requirements of WP29 expressed in this Opinion for consent exemption.