Realistically you won't be caught analyzing server-side logs of things the client is doing anyway, even if you don't follow GDPR rules with those logs. But they want Google Analytics, right?