GA4 is a black box your DPO struggles to defend.
After Schrems II and the 2022 rulings from the Italian DPA, the GA4 entry in the processing register got complicated. The easy answer would be "we no longer use it". The real one is "we have the data in-house".