Re: This is way too technical for me
I think (and am open to correction) that:
Websites use Google Analytics to find out what users do, where they came from, etc. It's what tells webadmins that 3% of their traffic comes from Texans, or 22,000 people clicked the link in that one retweet by a famous person, or that 22% of visitors abandoned purchases as soon as they saw the second Captcha, or whatever.
a) Google's position is that it's the publisher using GA's service's job to get permission for this data processing - that is, when you visit a site, the *site* has to ask you if they can record a bunch of stuff and pass it to google for processing.
b) It is also google's position that they're the 'controllers' of the data. That is, once you've clicked okay to the publishers' permission box google /decide how to work with it and what to use it for/ (i.e., how to use it for advertising).
c) finally, Google doesn't want to get sued inside-out if a website does part a) wrong... which is perhaps part of why a) is even a thing. If google has to request permission itself, then Google either gets it right, or gets it /catastrophically/ wrong and is liable for as many counts of the GDPR as there are EU citizens thanks to the scale of it's business. If individual sites have to do the asking then even if Google ends up liable the scale of the damage is limited.
It's presumably the case now that a site running google analytics gets some analytical data out about stuff but doesn't get any real involvement in how the user data feeds into google's advertising, so Google is happy to recommend competitor's products after you browse a given site - I know I've gotten Zoopla adverts after gawping at unaffordable houses on RightMove, for example. Maybe that's what google is worried about.
Biting the hand that feeds IT
