I thought Google Analytics could be GDPR compliant by simply not loading it until the user has consented? (i.e. the cookie popup hellscape we now live in)

The main issue is with 3rd party cookies which GA sets specially with countries like France and Italy.

Google Analytics can now be GDPR Compliant by loading the script from a server you own or control and anonymizing data before you send it to Google.