I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is possible. You just need to change some settings in Google Analytics: anonymize IPs, turn off "data sharing", whatever that is or whatever it means. But does this really make Google Analytics complaint with the GDPR without the user's consent? Is that guaranteed anywhere? I might be wrong, but I somehow get the feeling that this is just a "suggestion", to make things probably "better", but there might not be a valid legal explanation for this.
Basically the only way you can avoid consent in this case is by having a "legitimate interest", which in any case must be "reasonably expected" by the data subject (which means it can't be something totally unrelated, for example). The user can expect it is your legitimate interest to get some statistics on the traffic and the way the website is used. Other kinds of processing are probably not expected, and not to be considered "legitimate interests". So Google should probably not do anything with the Google Analytics data, except for providing the website owner with some innocent statistics. Now, is this guaranteed anywhere in Google privacy policies, in a way that makes it compliant with the GDPR?
So what I'm asking is: is it really possible to use Google Analytics on a website without user consent, and if so, what exactly makes it complaint? Changing some settings might be a good idea but not be enough, unless there's something that guarantees that's enough.