I think that is something only you (and your legal team) can answer and depends on how you interpret the GDPR regulations.
Based on my understanding of how this plugin works:
- IP address is not being stored
- No personal data is sent to Google
- Client ID is hashed and therefore cannot be used to identify an individual
- Client ID is stored for a minimum period of time
As such, in my opinion it probably complies with GDPR regulations, but I’m not a lawyer so obviously don’t take this as legal advice, and I may be wrong.
Hmm, well I did some more reading around the topic and now I’m not so sure whether it would comply with GDPR regulations. There’s an interesting discussion about a similar method here: https://news.ycombinator.com/item?id=25301500
If anyone else cares to offer their opinion, please chime in.