I think you miss the point: Google are the data processor in this case. (In fact, as the body collecting the data, they also have shades of a data controller.)

I think you miss the point: Google are the data processor in this case. (In fact, as the body collecting the data, they also have shades of a data controller.) Doesn't matter if they're a subcontractor: they have responsibilities under the GDPR, because they're the ones holding onto that data. It's not like they're holding it in some form, passing it on to the website owner, and obliterating it. I would recommend searching for the terms "data processor" and "data controller" on the European Commission website. They have very clear explanations of the responsibilities for both.