I've search on the interwebs and the only thing I can find is legalese that I could not understand.
Can someone assist?
You can check this article: https://gdpr.eu/cookies/
But it basically states that you should give your users the possibility of opting-out from tracking cookies, like the ones used by Google, and this is not GDPR, this is ePrivacy. To comply with GDPR, you should give your users the possibility to see their data, delete the data, etc. Since this is done by Google, it is their responsibility to comply with GDPR, and not yours (more or less... Let's say, it is YOUR responsibility, but you offloaded it to Google, which is compliant with GDPR apparently).
In any case, you should ask yourself why are you giving Google your users' data. Aren't your server logs enough to see who visits you?
There is definitely risk associated with running third party analytics and not having opt-in associated with that. It is very much not established whether GA's solution is good enough. Having said that, while there is a risk, at this point it seems to be a small risk of getting into GDPR trouble unless you are a very large operation.
That's what I tell my clients. YMMV.
Regarding the risk, I think the debate should go over what are you doing with your client's users data, giving it away to Google? Is it truly necessary? It is not only about risking a fine, is about being aware of what privacy means and what is it important.