According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "legitimate interest" in the context of a simple website that's just publishing articles in the open.
So first of all it is true that Google Analytics can use anonymized IPs, however GA also drops a tracking cookie used to distinguish users, with an expiration time of 2 years. And AFAIK tracking cookies are considered "personal data" under the GDPR, even if they are pseudo-anonymous.
Recital 47 says this:
The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest
So it seems possible, however due to the use of "may" all this says is that "analytics" can be regarded as a legitimate interest, however the publisher still needs to establish the legitimate interest.
And that same recital 47 says this:
... the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place
I don't see how visitors of a website can expect being tracked upon opening a website and the website can definitely work without tracking, so I don't see how this can be a legitimate interest.
So what am I missing, anybody with legal expertise that can help out?