Do you need Consent or Legitimate Interest to carry out analytics under GDPR?