Per the ePrivacy Directive you need consent to store non-necessary cookies client-side. E.g. Google Analytics cookies.
You're inadvertently confusing two different but somewhat related pieces of legislation.
"Cookie consent" banners and such are intended to address the requirements of the ePrivacy Directive. That requires you to get active, explicit consent from users when you want to store non-necessary cookies (or Storage or whatever) on their devices - client-side. In this context analytics cookies are not considered necessary. So if you want to use Google Analytics in the standard way you must ask for the user's consent to store Google Analytics cookies. If you don't get that consent then you are not allowed to store those cookies.
GDPR relates to 'personal data' stored organisation-side. There are six lawful bases (i.e. reasons) an organisation must choose from to store personal data. But it should not be storing any 'personal data' in Google Analytics "that Google could use or recognize as personally identifiable information" (my emphasis).
Your country should have some kind of data protection authority like the UK's Information Commissioner's Office and they ought to have produced guides to (A) the ePrivacy Directive and (B) GDPR.