I always find GA docs/instructions confusing, but when I try to see what current GA instructions tell you about how to include GA in a page, I get this:

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=[ID]"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());

      gtag('config', '[ID]');
    </script>

Is that the "old way" or the "new way"? Maybe it's an even newer way, which is essentially similar to the old way?

That’s the new way, including the illegal Tag Manager.

The old way would load the JS from https://ssl.google-analytics.com/ga.js instead, and set different options.

What about Tag Manager violates GPDR in special ways GA does not?

That's the new way, which comes with Tag Manager, which is a technically a separate product at Google.

Here is how to implement Google Analytics by itself:

https://developers.google.com/analytics/devguides/collection...