When using Site Kit, site owners are responsible for managing notice and consent requirements – including GDPR requirements – as described in Google’s Terms of Service.
By default, Site Kit does anonymize IP addresses upon activation of the Google Analytics module. This setting can be turned off in Site Kit > Settings > Analytics > Anonymize IP addresses.
In addition, Site Kit provides a mechanism in the form of a mini API for cookie consent plugins to integrate with Site Kit and prevent Site Kit’s Google service snippets from being rendered on a page if the user has not granted consent. More information about how this API works is available in this GitHub issue.