According to the French data protection agency (CNIL), user data collected via Google Analytics is transferred to the USA in violation of the GDPR. CNIL stated that Google's measures to regulate data transfers in the context of Google Analytics functionality are insufficient to prevent US intelligence services from accessing this data.

A similar decision was issued a few weeks ago by the Austrian Data Protection Authority. 

What's next? We are waiting for the results of an evaluation and an investigation. CNIL launched an evaluation programme to determine which website audience measurement and analysis services can be used to produce anonymous statistical data. The CNIL is currently investigating other tools used by websites that result in the transfer of data of European users to the USA.