Why not avoid all the asking for permission?
As I understand the cart cookie is allowed without permission since it is necessary for the shop to function and has no personal data in it, the analytics cookie(s) are not allowed.
So a solution might be not to place a cookie for the analytics at all. No cookie, no law to consider
Maybe a module has to be developped for server side cookieless analytics as described on the google code pages
http://code.google.com/p/php-ga/
I'm not fit to make a module out of it, but maybe someone else is. No cookie..... problem solved, right?