This is missing a critical clarification though. Are they talking about Universal Analytics, or GA4, which Google designed to hopefully be GDPR compliant?
"We have received several questions about whether, hypothetically speaking, we would move towards a different conclusion with Google Analytics 4. The Norwegian Data Protection Authority has not taken a position on this in the specific case, but as far as we can see, Google Analytics 4 will not necessarily correct those problems we have so far identified."
Along with a link to the findings of the danish government, which did test GA4 as well: https://www.datatilsynet.dk/english/google-analytics
(https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va... actual info from the norwegian data protection agency, in norwegian)