Some say as long as you anonymize user IP (call: ga('set', 'anonymizeIp', true);), you can only mention GA usage in privacy policy.