This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.
Huge swathes of Google's architecture (especially its legacy architecture) have deeply-ingrained location-agnosticism assumptions. It turns out to be extremely complex and expensive to remove those assumptions given the way Google handles data once it hits their datacenter fabric.
(Not impossible, mind, just that this assertion that it wouldn't be that hard to do is in "I could build Twitter in a weekend" territory).
My prediction is that as things move forward, they're going to find it isn't worth their money to offer Analytics for European customers if the GDPR continues to make that more onerous (especially since the monetization story of Analytics for Google is so threadbare) and just offer it for customers in other countries while Europe does its own thing. Win-win.
its real name should have been privacy hole
The CLOUD Act expressly brings data stored by US-based companies anywhere in the world under the purview of US warrants and subpoenas.
"The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil."
Calling it spying is a little far-fetched I think, when the problem was the transfer ip addresses to US servers, not Analytics itself.