I think the main thing is not to send your customers' data to third-parties without their consent. It's usually fine if you use internally analytics for the purpose of running the company, it's not fine if you send those data to other companies that use it for marketing purposes.
Isn't it? Isn't the problem that the data is sent to a third-party service outside EU (in the US) that doesn't offer the same data-protection rules as EU?
