It's possible for a developer to disable GA cookies and/or provide a different client ID to GA, which would make cross-site user tracking and identification of

It's possible for a developer to disable GA cookies and/or provide a different client ID to GA, which would make cross-site user tracking and identification of individuals more difficult. Google would still always get the IP and user-agent though, so maybe that's not enough. Proxying calls to GA and stripping anything which could contribute to a fingerprint should logically make it "legal" everywhere, I would have thought?