Doesn't Google Analytics forbid passing actual personal user data into it? I thought that's how they solved the GDPR compliance issues, by explicitly declaring it as not fit for personal data (outside what GA collects and anonymizes itself, like IPs).