From a technical standpoint, there are data sharing settings in Google Analytics [1] letting you control how much analytics data is shared with Google. Maybe they wanted it as part of the contract and not just a setting?
I'm not sure if you're misunderstanding me or if I'm misunderstanding you...
> data sharing settings in Google Analytics [1] letting you control how much analytics data is shared with Google.
It's in Google Analytics. It's all shared with Google. Or—more accurately—none of it is "shared" with Google, Google is just sharing some of it with you.
There may be settings allowing you to indicate your preference for what they will use for whatever internal purposes, but... Google have collected the data. There's no question of whether they receive it or not.
Storing things on a Google server isn't the same as sharing the data with Google for other purposes, for both technical and legal reasons.
This really depends on your trust model. Do you trust Google engineers to implement their own permissions correctly? Are you concerned about mistakes, or that they're entirely lawless?
Physical control means you can independently verify that no sharing is done, but it's not the only trust model.
Physical control is the only trust model with any kind of practical verifiability, so anything outside of that trust model is essentially blind trust.
This is obviously not a viable approach pragmatically (Mozilla must e.g. trust the hosting provider for their own data, distribution pipelines for their software, etc.), but these are all cases where reasonable precaution can be taken (signing, etc.). Google Analytics' APIs support no such measures.
> Are you concerned ... that they're entirely lawless?
This is a bit of a strawman / hyperbolic question. A company or its employees needn't be "entirely lawless" (whatever this extreme phrase even means), to be outside of regulatory compliance. And the latter is something Google are found to be on a very regular basis.
[1] https://support.google.com/analytics/answer/1011397