The main criticisms are that GA collect users' data without consent, without telling them what they collect and without giving them a simple way to get their data reliably deleted,
all of which are forbidden according to german law. And before people start complaining that GA doens't collect personal information: there seems to be an emerging legal consensus in germany that an IP address is in fact a personally identifiable information. Nobody has ever been taken to court for running an apache with the default logging configuration, but there are people who think that that is an offence worth a fine of up to €50.000,-- too, just like running GA.
For those who can read german, here is a better text:
http://www.heise.de/newsticker/meldung/Bundesdatenschutzbeaf...