You may be able to legally rely on "legitimate interest" for internal-only analytics. You would almost certainly be able to get away with it for a long time.