First of all I must say that I am no lawyer and do my research to the best of my knowledge and belief.
You are right. The collection of PERSONAL DATA is only allowed when there is a legitimate interest for that data (47) [which is not given at this point] or that the consent is “freely given” (32) [when people refuse, they must still be able to have full access to the service]. (GDPR)
In court decision from 24. November 2011 (Az. C-70/10) the European Court of Justice said, that IP address are personal data. Thus, IP address have to be anonymizised for tracking since then. They have relied, inter alia, on 2002/58 / EC (E-Privacy-Directive from 2002).
In consequence Google Analytics for example added the function anonymizeIP. It is only legal to track anonymized data right now and in Germany everybody is doing it that way. I don’t know how it is handled in other EU-Country.
I would love to keep tracking anonymized data already on pageload. I am allowed to do so still with GDPR, as far as I know. And also before GDPR I am committed to provide an opt-out link (in privacy policy).
Maybe E-Privacy-Regulation will go into detail with this in 2019.