Sweden's data protection watchdog has issued a couple of fines in relation to exports of European users' data via Google Analytics.
For clarity: This relates explicitly to UA not GA4. That doesn’t however mean that the current version is deemed GDPR compliant; that is likely something that a future investigation will decide.
Google claims that GA4 should be compliant, but at the same time they have also for years until a few days ago been providing a version of GA that wasn’t.
I use a self-hosted instance of Plausible Analytics. It's privacy-respecting and the analytics data is only available the site operators, not shared to any big corp to optimize the monetization effort. And as a bonus, it's not blocked by any ad blocker so the data is more accurate.
And even though they might be good, knowing the internet today, I find myself incapable of trusting them... anything that starts off in ad-format makes me icky and unsure. It could be the best tool in the world, but I hate pitches.
PS: Yes, I know I am linking to their pitch, but I'm not the kind to hide links. Better have them all out to discuss than tucked away.
The key point is you can self-host it and the source is open. If PA getting shitty in the future, you can just keep your instance in the last known good version, or even use a forked version if someone decided to fork.