In light of this significant development, we have updated our coverage to reflect the latest information. To stay up-to-date on the new EU-US Data Privacy Framework agreement and its implications, we invite you to read our latest article on the topic.
🔍 Discover the latest: EU to USA Personal Data Transfers Now Approved
Thank you for your continued support and trust in our coverage of important global issues!
You might have heard talk of Google Analytics being illegal in Europe or violating the GDPR. Like most things related to privacy, it’s not always that straightforward. We’ve written this post to explain better what all the talk is about, what it might mean so far, and how it could affect you if you use Google Analytics in Europe.
Based in the UK? Then this post is also relevant to you as the GDPR rules are still applicable in the UK under the “UK GDPR.”
👉 What happened: Several European data protection authorities have found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. The authorities deemed Google Analytics compliance measures to be insufficient as a result of investigations conducted in relation to the use of Google Analytics 3. Here’s why →
👉 Google’s response: Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some of the concerns.
👉 Do you need to stop using Google Analytics altogether? There’s no direct answer yet as this is a developing case. Some Authorities, like the Italian Garante, have stated that if you choose to continue using Google Analytics, additional security measures must be taken. Google Analytics 4 attempts to address the main concerns, but keep in mind that since the DPA investigations were based on Google Analytics 3, there is, as of yet, no way to know definitively if the Authorities will consider the use of GA4 to be enough. More info on what you can do here →
To understand the most recent decisions that have impacted Google Analytics 3, we have to look back to the Schrems II verdict published by the European Union’s Court of Justice in July 2020.
Schrems II declared the “Privacy Shield” invalid. The Privacy Shield framework allowed and validated transfers between the US and the EU. Since the framework was declared invalid, any data transfers between the EU and the US are prohibited unless participants, such as data controllers or processors, take additional measures to meet European standards of adequacy (for the protection of data).
You might be asking yourself why EU-US data transfers are prohibited unless extra precaution is taken? The reason for this hinges on the CLOUD ACT, which requires US-based companies, such as Google Analytics, to transmit data in their possession, custody, or control to US government agencies, regardless of whether the data is stored inside or outside the US.
The French, Austrian, Danish, and Italian Data Protection Authorities (DPAs), found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. The mentioned European DPAs carried out these investigations in collaboration and in response to a number of complaints.
As a result, the authorities deemed Google Analytics 3 compliance measures insufficient.
Follow this evolving case law and watch the latest decisions unfold below:
We will keep updating this post as the situation develops. Last updated: September 2022
Update: On the 27th and 28th of September, the Italian Data Protection Authority published the decisions issued on the 7th and 21st of July against IlMeteo S.r.l. and Fastweb S.p.A. concerning the use of Google Analytics. The decisions only concern the use of Analytics 3 (GA 4 could not be taken into account because the complaints were made prior) and contain the same grounds as the first decision issued by the Garante on 9.6.2022.
As in the first case, the Italian Authority concludes with a warning and an order to comply within the 90-day period, taking appropriate additional measures. Otherwise, the Garante may issue an order suspending the flow of personal data to Google LLC.
On 23rd June 2022, the Italian DPA (Garante) has agreed with The French, Austrian and Danish DPAs, releasing a decision ordering the organization involved in the proceeding to verify that their use of cookies and other tracking tools comply with data protection regulations, with particular attention to Google Analytics 3 and similar services.
Websites using Google Analytics 3, without the safeguards provided by the EU Regulation, violate data protection law as user data is transferred to the United States, a country without an adequate level of protection.
👉 The Garante made this decision at the conclusion of a thorough investigation.
👉 The investigation revealed that organizations using Google Analytics 3 collect data, through cookies, on how users interact with those websites, including the specific pages visited and the services used.
👉 The IP address of the user’s device, details about the browser, operating system, screen resolution, selected language, and the date and time of the website visitors are among the several pieces of data gathered. It was emphasized in the Guarantee decision that IP address is personal data and that even if it were abbreviated, Google would still be able to read it with other data and capabilities it has. This is why the processing was declared unlawful.
The French DPA (CNIL) released a decision on February 10th, 2022 ordering a French website manager to comply with the General Data Protection Regulation (GDPR) and to discontinue the use of Google Analytics 3.
CNIL has recently published FAQs on the topic. The CNIL posted this document on its site to clear any doubts regarding the decision made on February 10. However, they haven’t added anything new to what has already been announced in the Authority’s decision.
As far as the FAQs are concerned, there are no particular changes to what the Authority already stated in its decision of 10.2.2022. It is just that the arguments have been reported in a more schematic manner:
👉 the additional measures put in place by Google Analytics 3 are not sufficient to prevent access by US government agencies under the CLOUD Act;
👉 the website operator has one month to discontinue the service and opt for another service that is compliant;
👉 a proxyfication method can be considered, which allows, when properly configured, to send only pseudonymized data to a server located outside the EU.
The Austrian DPA (DSB) published a decision on April 22nd, 2022 in which they found an unnamed EU website operator in violation of Article 44 of the GDPR.
👉 The DSB explained that by using Google Analytics 3, the website operator gave Google LLC access to browser information, IP addresses, and unique user identification numbers.
👉 Although the website operator acknowledged that Standard Contractual Clauses (SCCs) had been reached with Google LLC, the DSB determined that these SCCs did not offer an acceptable level of protection in accordance with Article 44 of the GDPR.
👉 The DSB determined that Chapter V of the GDPR could not be implemented when using Google Analytics 3. The website operator had stopped using the tool before the complaint procedure was over, so it was not necessary to use its enforcement powers in this case.
In a press release from the Danish DPA (Datatilsynet), the authority has said,
if you use Google Analytics, you must put in place a plan to bring your use of (Google Analytics) into compliance by implementing supplementary measures.
They mention the use of pseudonymization as one possible technical measure that may be relevant when using Google Analytics. Datatilsynet also points to the guidance created by The French Data Protection Authority for organizations wishing to establish effective pseudonymization by means of a so-called reverse proxy.
👉 On the basis of the Austrian judgment as well as the other expected decisions regarding the use of Google Analytics, the Danish Data Protection Agency plans to prepare a summary, indicative text.
👉The Datatilsynet emphasized the need for authorities to share a common understanding of the decision because it involves a set of shared European rules.
On 15 December 2022, the Spanish Data Protection Authority issued a decision in response to one of the complaints filed by NOYB concerning the unlawful use of Google Analytics.
The Spanish Authority takes a different approach than other DPAs in transferring personal data when using Google Analytics, as the decision is based on the limited use of Google Analytics by the company involved.
👉 Unlike previous decisions, the Spanish DPA did not order the company to stop using Google Analytics or to use a tool that does not involve a transfer outside the EU.
Instead, the Authority concluded that there was no evidence of a breach of the GDPR and decided not to pursue the investigation and sanction either the company or Google. In particular, the Authority argued that the company stopped using Google Analytics shortly after becoming aware of the Schrems II ruling and did not process data to identify website users.
Furthermore, the authorities found that, prior to the discontinuation, the use of the service was compliant as it was carried out on a limited level and in view of the following factors:
Given the above, the Authority ruled out the offence because the company did not transfer the personal data of EU users to the US, precisely since it did not process the data.
The Spanish DPA’s ruling cannot be considered conclusive as the jurisprudential and political scenario remains in flux. Therefore, upcoming developments still need to be monitored.
The Norwegian data protection authority, Datatilsynet, has issued guidance on website analytics and tracking which includes but is not limited to: the maintenance of compliance with the GDPR, minimisation of data collection and the avoidance of personal data flow to unsafe third countries.
This guidance follows the release of Datatilsynet’s decision on Google Analytics in response to a complaint lodged by noyb against the telecommunication company Telenor ASA in relation to its website, telenor.com. Datatilsynet concluded that “when the website used Google Analytics, personal data was transferred to the United States in violation of the rules. In other words, the use of Google Analytics was illegal.” It therefore issued a reprimand “to Telenor for having transferred personal data to a third country without complying with the conditions laid down in Chapter V GDPR, in violation of Article 44 GDPR.”
Datatilsynet has also considered that the EU-US DPF now makes it easier to legally transfer personal data to self-certified companies in the United States, which also includes Google. However, the DPA does not rule out that there may be other privacy challenges with the tool and therefore directs users to its newly issued guidance.
Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some of the concerns.
For more detailed information on Google Analytics 4 see here.
As it is still difficult to gauge the impact of the decision on Google Analytics, it is up to each business to decide on which action to take.
Since the main issue at hand is the transfer of European data to the US and the potential risks involved, in general, it could be a good idea to:
*Please be aware, however, that since the DPA investigations were based on Google Analytics 3, there’s as of yet no way to know definitively if the Authorities will consider the use of GA4 to be enough.
If you choose to continue using Google Analytics, here are a few things you can do to bring you closer to compliance:
Data Protection Authorities found that data transfers to the US don’t have the same protection standards as in the EU.
The situation stems from a set of U.S. laws that allow government organizations to request access to consumers’ personal data from US-based services, regardless of where the data centers or servers are located.
In light of this, NOYB filed 101 complaints with European DPAs to find that transferring European users’ data to the U.S. was unlawful. The decisions, which have noted the illegitimacy of the transfers, focus on the analysis of additional technical, contractual and organizational measures.
The use of an encryption key by the company in question was deemed insufficient as the key was owned by Google LLC. From this, it follows that as long as the encryption key remains accessible to the importer (in this case, Google Analytics), the measures taken cannot be considered appropriate.
Furthermore, contractual and organizational measures are not evaluated because the others are always considered insufficient if technical measures are missing.
Based on the decisions issued so far, we can assume that the possible legal consequences are as follows:
Please note that to date, no economic sanctions are being issued for the use of Google Analytics.
*As always, we’re following this evolving case and will keep this post updated with the latest developments. Bookmark this post to make sure that you don’t miss an update!
