I am afraid it is not so simple. There is a thing with data collector, and data controller in GDPR I don't full understand yet. It's not like you're not responsible for data collected by services that you hook up to your application.

You are the data controller because you decided that people who visit uour site would also load GA scripts. You decide what is done with their PII. GA is just a data processor.