Even if you only use first-party analytics, you're still tracking users and may still pipe that data to third parties, so you still need a lawful basis for proc

Even if you only use first-party analytics, you're still tracking users and may still pipe that data to third parties, so you still need a lawful basis for processing PII (of which consent is the least useful one). Even the use of the word "cookie" is framing by industry to confuse people.