It it true, e.g. see here:

https://isgoogleanalyticsillegal.com/

https://plausible.io/blog/google-analytics-illegal

Law is a code that needs to be interpreted by society. This interpretation is done by judge rulings. There is a growing number of rulings that Google Analytics, and in fact any sending of customer PII to US-owned legal entities, is illegal.

Naturally, smaller companies won't be sued, right now. But the more time passes, the clearer it becomes that given the current GDPR and US laws, it's illegal.

Most cookie content popups and forms that you see are also flagrantly illegal under the GDPR.

The problem is that enforcement is rare and small scale compared to the overall scope of the problem. In both of these cases it's a day late and orders of magnitude short.

The Schrems II stuff is a situation where many of the politicians and the businesses really don't want to have to do anything and so they just kinda ignore the law until privacy advocates force their hand. So enforcement is effectively non-existent; the hope being that they can just run out the clock until some sort of legislation magically fixes the issue.