The consent banner. GA4 stores an identifier on the visitor's device, so in the EEA and the UK it needs consent, and every visitor who declines is a visitor you cannot count. Tools that identify visitors without touching the device sidestep both the banner and the hole in the numbers. What "storing on the device" actually means is set out here.
The legal position. Several EU regulators have ruled against particular GA deployments, and the Data Privacy Framework changed the ground again in 2023. It is not the simple "banned" a lot of posts claim, and it is not settled either: what the rulings actually said.
Reports that stop answering the question. Free GA4 keeps event-level data for at most 14 months, and explorations over 10 million events are sampled. Standard reports are neither. The moment you ask something unusual about a busy site, the answer is an estimate drawn from a window that has already closed.
The learning curve. GA4 is a modelling tool. If nobody on the team wants to define events and parameters before the first useful number, most of it goes unused.