The data stored by Google Analytics is most definitely not aggregated. Go into the User Explorer report (under "Audience): you will be able to trace the individ

The data stored by Google Analytics is most definitely not aggregated. Go into the User Explorer report (under "Audience): you will be able to trace the individual interactions of each visitor to your site. GDPR considers this data be pseudonymous, which is distinct from anonymous. The ePD (a different EU data privacy law) requires IP anonymization. That feature is necessary, but not sufficient, to comply with the ePD. The ePD is a whole ball of worms in its own right, and I have a lower opinion of its value than I do of GDPR. I'm not sure whether those features are sufficient for GDPR and international transfers, though. The issue is that IP address is still received by Google servers, even if it's deleted right afterwards, so a transfer still takes place. But it might be possible to make that a compliant transfer if you sign SCCs with Google (I can't figure out if they offer this for Analytics!), and implement "additional safeguards." There's an argument that IP anonymization would constitute sufficient safeguards in the absence of other identifiers, but that's beyond my expertise.