By default, the plugin does not track any Personally Identifiable Information (PII), so there shouldn't be any privacy concerns when used “out-of-the-box”. However, since this is an international legal matter, it’s advisable to consult a lawyer regarding your specific case.

When enabled, the plugin only sends the following information:

• A persistent random client ID.
• Screen resolution.
• Current language.

You have full control over the opt-in/opt-out strategy in your application. In the Project Settings, you can set the Opt Out Default option to determine whether users must explicitly opt-in or opt-out of tracking in your application. Of course, you will need to provide the user interface and code to change this setting using the plugin API if necessary.

Disclaimers depend on Google Analytics policies as well as what you log. For Google policies, refer to the following resources:

• Google Analytics Terms: the Terms of Service for using Google Analytics.
• Google Analytics Policies: a list of important limitations and requirements regarding logged data.
• Understanding PII in Google's Contracts and Policies.
• Data Privacy and Security: this section contains all related information about Google Analytics privacy.
• Best Practices to Avoid Sending Personally Identifiable Information (PII): in particular this document mentions that “To protect user privacy, Google policies mandate that no data be passed to Google that Google could use or recognize as personally identifiable information (PII).”

Depending on what you log, the disclaimer you need to use could change. Again, it is essential to consult a lawyer for details specific to your situation.