Indeed, Google acts as a data processor for its cloud products like Analytics. A data processor has no obligation and no right to fulfill a DSAR. It can be argued that the processor should forward the request to the correct controller, but the opposite can be argued as well.
If you submit a DSAR to Google Analytics as a whole then you cannot get any meaningful response, for technical and legal reasons.
To figure out which data controllers might hold data about you, Google would have to search their customer's database for information about you. But performing such a search would break their duties as a data processor.
Google Analytics is designed in such a manner that there is no cross-site user identifier, so Google wouldn't be able to tell which customers hold data about you even if it wanted to.
In contrast, if you were to submit a DSAR to Google about all Analytics data that relates to a website example.com, then it could be argued more reasonably that Google should forward the request to the example.com data controller. In practice, I think Google would decline to do this unless ordered to do so by a court.
That a data processor might have any obligation to forward a DSAR might be derived from Art 28(3)(e) GDPR:
That [data processing agreement] shall stipulate, in particular, that the processor: […]
(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III
One way in which Google Analytics fulfills this responsibility is in offering a user interface through which the data controller can search the pseudonymous user profiles by a user's ClientID, and can export or delete that user's profile.
Google Analytics is often – but not necessarily – used together with Google's Ads products. For those, Google is the data controller, and could be a valid target for a DSAR.
