For clarity: This relates explicitly to UA not GA4. That doesn’t however mean that the current version is deemed GDPR compliant; that is likely something that a future investigation will decide.
Google claims that GA4 should be compliant, but at the same time they have also for years until a few days ago been providing a version of GA that wasn’t.
I found this article of theirs to be shamelessly plugging: https://plausible.io/blog/google-analytics-illegal
And even though they might be good, knowing the internet today, I find myself incapable of trusting them… anything that starts off in ad-format makes me icky and unsure. It could be the best tool in the world, but I hate pitches.
PS: Yes, I know I am linking to their pitch, but I’m not the kind to hide links. Better have them all out to discuss than tucked away.
The key point is you can self-host it and the source is open. If PA getting shitty in the future, you can just keep your instance in the last known good version, or even use a forked version if someone decided to fork.