Replying to @blackfoundry and @davelab6, @bfluzin
Obviously I am not a lawyer but I would say: if you collect just what you need to identify uniques, if you minimise the data properly (eg. keep the referring domain but not URL and keep the data only for the month you need it in before aggregating) then you’re really fine.