Google Analytics consultant here. A plain-vanilla GA installation does not connect GA data to any of Google's data. Google is a Processor under GDPR & Service

Google Analytics consultant here. A plain-vanilla GA installation does not connect GA data to any of Google's data. Google is a Processor under GDPR & Service Provider under CCPA, meaning that the data "belongs" to the site owner and Google has no legal rights to use it for their own purposes. BUT A key feature of Google Analytics is integration with the rest of the Google ecosystem, including Google Ads (formerly AdWords) and Display & Video (formerly DoubleClick). It is extremely easy to connect GA data with Google's data. Configurations that give Google legal access to the data are easy and common. (If you remarket using GA, Google is not just a service provider.) From a GDPR perspective using Google Analytics is still problematic because of Schrems II. Any data transfer to a US-controlled entity is troublesome, because the EU has declared that US does not adequately safeguard user data (the main sticking point is the lack of accountability of law enforcement & intelligence agencies to request access to the data). But that's about the US, not about Google specifically.