Its possible to anonymize the IP in GA Analytics
I assume the issue with breaking GDPR is with the users IP address (considered PIIl data) being sent to the USA. But Google Analytics can be configured to anonymze the users IP, which 'should' comply with the EU (and UK) GDPR
ref:
https://support.google.com/analytics/answer/2763052?hl=en
Perhaps the webmaster was unaware of this setting?
Biting the hand that feeds IT
