“In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds.”
Google Analytics ships visitor data to the US, where intelligence agencies can reach it, and Google’s extra safeguards don’t fix that. Truncating the IP doesn’t help when Google can fill in the rest. One site operator got 90 days to comply, and every other Italian site got a warning and the promise of inspections. Free analytics was always paid for with your visitors.