Earlier quoted context omitted.
It is against the terms of service of Google analytics to pass any PII such that you can track an event back to any particular person. On top of that, the code for Google Analytics js is available for your review, along with its network requests, such that you can hold them to their word.
The section about "personally identifiable" information in the Google Analytics Terms of Service [1] does not limit Google, but the site using GA. Practically, I'm not sure that can even be enforced, or that Google has any incentive to enforce it. If a site uniquely tags each user via custom variables, or by sending users to a unique resource/goal/interim URL, will Google detect this and obscure/destroy the resulting…
https://developers.google.com/analytics/devguides/collection...