This assumes Google is trustworthy. Their business being based on advertising and stealing as much data as possible off everyone, would you trust them to keep their word and work against their bottom line?
Because the consequences of claiming these things but actually not doing them would be both prohibitively large and impossible to avoid in a large company with a history of whistleblowing employees.
Somewhere in the settings, you have the option to anonymise users, which is achieved by deleting/not saving the last triplet of IP addresses.
There are some other options, and some functions you should avoid:
- You should set data retention to the minimum of 14 months
- Do not use the User-ID functionality (tracking across devices/browsers)
- Also avoid Remarketing and Advertising Report features.
The downside to all this is that it is mostly invisible to users that you are somewhat protective of their privacy.