By default, the plugin does not track any Personally Identifiable Information (PII), so there shouldn't be any privacy concerns when used “out-of-the-box”. However, since this is an international legal matter, it’s advisable to consult a lawyer regarding your specific case.
When enabled, the plugin only sends the following information:
You have full control over the opt-in/opt-out strategy in your application. In the Project Settings, you can set the Opt Out Default option to determine whether users must explicitly opt-in or opt-out of tracking in your application. Of course, you will need to provide the user interface and code to change this setting using the plugin API if necessary.
Disclaimers depend on Google Analytics policies as well as what you log. For Google policies, refer to the following resources:
Depending on what you log, the disclaimer you need to use could change. Again, it is essential to consult a lawyer for details specific to your situation.