You’re right, but also wrong. Not all collection is equal. Placing your payment data in a database that is strictly for legal purposes is different than placing in a connected database built to track users around the web.

Privacy laws allow you to keep the data only for as long as legally necessary and required. Google Analytics may keep this data indefinitely.

Can we verify that?

> [...] the Italian [Data Protection Agency GPDP] reiterated that an IP address is personal data and would not be anonymised even if it were shortened – given Google’s capabilities to enrich such data through additional information it holds.

> [...] DSB issued a second decision, declaring the use of Google’s IP anonymisation a useless protection measure for data transfers between the EU and the United States.

https://noyb.eu/en/update-further-eu-dpa-orders-stop-google-...

Their servers still get your IP tho and by default nothing in USA is GDPR compatible because US government can enforce leaking any info they want from company