Consent for cookies is not mandated by the GDPR, but by some member states' implementation of the ePrivacy directive. Specifically, cookie consent
- isn't required for processing personal data (which the GDPR is about),
- but for storing anything on the user's device unless this cookie is technically necessary (e.g. session cookies, preferences).
This leads to a situation where you might not need consent for the analytics themselves, but still need consent for the cookies that are used to track a user for analytics.
In practice, the cookie consent requirements are handled very differently. Some sites ignore this requirement, others show a notification banner that doesn't collect active consent like the GDPR would require. Yet other sites bundle cookie consent with other consent issues into a single consent management solution.
Currently, the passive notification looks like a best practice in general. However, the actual privacy laws in your member state might have more specific requirements.
With regards to consent for Google Analytics, note that the use of anonymizeIP does not directly affect whether you have to collect consent.
- The purpose of collecting site analytics might fall under your legitimate interest either way (consent is just one among many legal bases).
- But using the anonymizeIP feature conforms to the GDPR's data minimization principle.
- Some optional GA features (that share this data, or enrich it from other sources, or use it to target ads) might still require consent.
The GA documentation doesn't always make this distinction clear.