google or other providers could mitigate this by Allowing the Analytics subscriber to configure which fields to "exclude" or "include" when logging requests.

Regulators are only going to get tougher with service providers, it's wise to prepare.