When a company with the reach and market share of Google is involved, "anonymized" is meaningless. They have so many other channels to gather data (Android, ReCaptcha, Chrome, Google Search, etc.) that I'm sure it's trivial to de-anonymize and correlate GA data to a real person if that becomes profitable/necessary.