The Italian DPA follows same position as other EU DPAs.
Notable mentions of impact if GA used in connection with Google account logins, that “IP anonymisation by Google” is not truely anonymization and that Google’s processing mostly in EU being not sufficient.
Also, on encryption (google-translated below):
“With regard to the data encryption mechanisms highlighted above, they are not sufficient to avoid the risks of access, for national security purposes, to the data transferred from the European Union by the public authorities of the United States, as the encryption techniques adopted provide that the availability of the encryption key is in the hands of Google LLC which holds it, as an importer, by virtue of the need to have the data in clear text to carry out processing and provide services.”
https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9808698