You must obtain consent for using any cookies that are not strictly necessary to perform the service requested by the user. This stems from the ePrivacy directive, respectively your country's implementation of this directive. Consent is currently defined by the GDPR. It does not matter whether the cookies actually involve personal data.
Analytics are not strictly necessary. Before using cookies or similar technologies for analytics, you will need to obtain consent.
“Consent” under the GDPR has fairly high requirements. It requires that the user has made a conscious decision, that they made the decision freely and informed, and that they can give/withhold consent for specific purposes – bundling is not allowed.
You cannot make a service conditional on unrelated consent. Users must be able to use your application without giving consent to analytics cookies. Of course, it is possible to make a service conditional on related consent, e.g. of course a videoconferencing system can only work if the users gives consent to access camera/microphone.
If you do not collect valid consent, the resulting processing activities are illegal. You as the data controller must be able to demonstrate that valid consent was obtained. This is often interpreted to mean that you must store a record that registers the consent event for later audit. I think it is more important to ensure that your consent flow is demonstrably GDPR-compliant, in particular that you can show that users' consent is informed and freely given.
I therefore think that you will have to show your cookie dialog within your app as well. You should not set or access analytics cookies until such consent has been given. You cannot assume that consent has been given by default: consent is opt-in, not opt-out.
- Cookie consent is required by ePrivacy Art 5(3), where cookies correspond to “information […] in the terminal equipment of a subscriber or user”. Exempted from the consent requirement are cookies that are technologically necessary, and access “as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”. National law must provide equivalent conditions.
- Consent is defined in GDPR Art 4(11) and applies for cookie consent per ePrivacy Art 2(f) in conjunction with GDPR Art 94.
- Conditions for consent are expanded in GDPR Art 7.
- The EDPB has issued guidelines on consent.