You may be able to argue a GDPR Art. 6 lit 1b (necessary to perform a contract) or a 1f (legitimate interest) reason to track, but you will need to, at the very least, inform the user. Storing data on the user's device (cookies, local storage, etc) also requires the user to be notified thanks to the ePrivacy directive.