The GDPR came in effect in 2018 (May 25). When it did, most companies scrambled to comply.
Back then I researched the analytics situation and can say from what I remember (and my POV):
- It was super clear it was a touchy subject, because you're basically disclosing private information (IP, tech capabilities, some browsing history, etc.) to a third party who may or may not comply with GDPR's basic requirements about data protection, right to be forgotten, etc.
- It was super clear there were some minimum requirements, like anonymizing IPs, limiting storage of data, storing the data in Europe, or making sure URLs didn't disclose personal information.
- Google didn't say much about compliance of GA. Their text was more about shifting the responsibility to web admins. Possibly because there were some doubts, like the validity of the Privacy Shield, which eventually was deemed invalid.
- Other analytics tools, like Matomo, offered configuration settings for anonymizing visitors and limiting storage.
- It was often suggested you could solve the issues by having users opt-in to analytics. e.g. "This tool by itself is not in violation, you are in violation if you didn't ask for consent before using it". The "guns don't kill people" argument. However, anyone would agree that if you can only track consenting people your analytics get super skewed, maybe to the point of being useless.
One of the main issues back then was that the GDPR doesn't talk about cookies at all, because a separate legislation (updating the existing ones) was going to cover that afterwards. This created a lot of doubts of whether an analytics solution based on cookies (without opt-in) could even be compliant at all. Current understanding is that certain cookies (e.g. login cookies) are and will be OK, while others (cross-site tracking) are absolutely not.
I think the reason decisions started coming as late as 2022 is because implementation was super late, and people are still learning about these things. There are still a lot of touchy subjects, like how to deal with YouTube embeds, Google Maps, etc.