Only half the truth and a common misunderstanding. Define "visitor statistics". GDPR is about personal information, yes, but the cookie directive is also about tracking features in general. See the current so called "cookie verdict". To break it down: If you just count page impressions, you should be fine. Everything beyond is complicated. (Besides that, it does not matter where you host the data, on-premise or on foreign soil or if you use cookies or any other storing technology.)