Right, how did I forget about those? That even is exactly the type of data that will allow identifying specific devices underneath one public IP.

I don't know Google's privacy policy too well and I'm not a lawyer, but I think, this is still kind of uncharted legal territory.

No end user ever gets to see Google's privacy policy before their data is submitted to Google. Not even for Google Analytics, where I am pretty sure that Google does use the data, if the webpage owner isn't paying.

At the same time, Google will point to webpage owners, saying that they need to inform their users (which they do), but if Google wanted to "do the right thing", they would acknowledge that clearly webpage owners don't do that, and that therefore essentially any usage of Google Analytics data happens without user consent.

Under the GDPR, something like this would almost certainly not be legal and Google would be responsible, too, even if they're not the "controller", just the "processor", as the GDPR calls it.

Of course, we'll only know for sure once the lawsuits against Google have gone through.

It's not allowed under the GDPR. But let us get real; this is Google doing it, and anyone complaining about this practice would first need to prove that it happens (which is not easy). You can (and should) expect large American companies to always ignore as many laws as they can get away with.