It's part of the Data Processing Agreement that Google offers to the users/customers of Google Analytics. You can dig through the legalese, but the salient aspe

It's part of the Data Processing Agreement that Google offers to the users/customers of Google Analytics. You can dig through the legalese, but the salient aspect is that Google describes itself as a "Processor" and not a "Controller." This means that they do not use the data for their own purposes. Google's approach to GDPR compliance is entirely based around the idea that they're a Processor and it's not really their data, they're just the middleman. I would believe them because they have a lot riding on that.