You can't do any form of user testing or heatmaps with server logs. And whilst real user testing is undertaken, sometimes the passive collection of heatmap data etc. is best done in an unbiased environment (i.e. you don't know you are being tested).
There are plenty of open-source analytics tools that you can self-host, like Open Web Analytics. You can gather all the information you need for usability testing without handing it over to a third party and compromising the privacy of your users.
Of course they can, but there is always a cost of hosting your own infra. There is a strong argument for the gov to be doing this in house, but I suspect it's not 100% the case and individual departments have the freedom to put their own tracking codes on their own site.
What if they ask for permission in a less intrusive way? Like I dunno, send people an e-mail after using the site once with clear information?
Well, you will need GDPR checkboxes/disclaimers and a form to capture email. How is this more user friendly?
They could make the prompt less intrusive (on average) by only asking a random sample and just not tracking the rest.