Google analytics isn't excluded from GDPR, because google analytics doesn't exist in a vacuum, it is used on a website. So the owners of the website are the ones who are responsble from a GDPR point if view.
At least, that is what Google are claiming.
However, AIUI, for Google Analytics, Google collect, collate, process, and store the data, on the website operators behalf. Now, I am not a lawyer, but that sounds very much like Google collect, etc...
The courts will decide, and given Googles record on this one, I wouldn't be putting much confidence in their legal team winning. Afterall, they only managed to actually understand that the previous data protection rules didn't care where they source the data from when CJEU explained it to them, even though this was normally covered in Data Protection 101 for technical staff.