Iubenda logo
Start generating

Documentation

Table of Contents

Is Google Analytics illegal in the EU and UK?

You might have heard talk of Google Analytics being illegal in Europe or violating the GDPR. Like most things related to privacy, it’s not always that straightforward. We’ve written this post to explain better what all the talk is about, what it might mean so far, and how it could affect you if you use Google Analytics in Europe.

Based in the UK? Then this post is also relevant to you as the GDPR rules are still applicable in the UK under the “UK GDPR.” 

In Short

👉 What happened: Several European data protection authorities have found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. The authorities deemed Google Analytics compliance measures to be insufficient as a result of investigations conducted in relation to the use of Google Analytics 3. Here’s why →

👉 Google’s response: Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some of the concerns.

👉 Do you need to stop using Google Analytics altogether? There’s no direct answer yet as this is a developing case. Some Authorities, like the Italian Garante, have stated that if you choose to continue using Google Analytics, additional security measures must be taken. Google Analytics 4 attempts to address the main concerns, but keep in mind that since the DPA investigations were based on Google Analytics 3, there is, as of yet, no way to know definitively if the Authorities will consider the use of GA4 to be enough. More info on what you can do here → 

What is the legal reasoning behind the Google Analytics decision?

To understand the most recent decisions that have impacted Google Analytics 3, we have to look back to the Schrems II verdict published by the European Union’s Court of Justice in July 2020.

Schrems II declared the “Privacy Shield” invalid. The Privacy Shield framework allowed and validated transfers between the US and the EU. Since the framework was declared invalid, any data transfers between the EU and the US are prohibited unless participants, such as data controllers or processors, take additional measures to meet European standards of adequacy (for the protection of data). 

You might be asking yourself why EU-US data transfers are prohibited unless extra precaution is taken? The reason for this hinges on the CLOUD ACT, which requires US-based companies, such as Google Analytics, to transmit data in their possession, custody, or control to US government agencies, regardless of whether the data is stored inside or outside the US.

The French, Austrian, Danish, and Italian Data Protection Authorities (DPAs), found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. The mentioned European DPAs carried out these investigations in collaboration and in response to a number of complaints.

As a result, the authorities deemed Google Analytics 3 compliance measures insufficient.

By-country breakdown

Follow this evolving case law and watch the latest decisions unfold below:

We will keep updating this post as the situation develops. Last updated: September 2022

Update: On the 27th and 28th of September, the Italian Data Protection Authority published the decisions issued on the 7th and 21st of July against IlMeteo S.r.l. and Fastweb S.p.A. concerning the use of Google Analytics. The decisions only concern the use of Analytics 3 (GA 4 could not be taken into account because the complaints were made prior) and contain the same grounds as the first decision issued by the Garante on 9.6.2022.

As in the first case, the Italian Authority concludes with a warning and an order to comply within the 90-day period, taking appropriate additional measures. Otherwise, the Garante may issue an order suspending the flow of personal data to Google LLC.

On 23rd June 2022, the Italian DPA (Garante) has agreed with The French, Austrian and Danish DPAs, releasing a decision ordering the organization involved in the proceeding to verify that their use of cookies and other tracking tools comply with data protection regulations, with particular attention to Google Analytics 3 and similar services.

Websites using Google Analytics 3, *without the safeguards provided by the EU Regulation*, violate data protection law as user data is transferred to the United States, a country without an adequate level of protection.

Key points

👉 The Garante made this decision at the conclusion of a thorough investigation.

👉 The investigation revealed that organizations using Google Analytics 3 collect data, through cookies, on how users interact with those websites, including the specific pages visited and the services used.

👉 The IP address of the user’s device, details about the browser, operating system, screen resolution, selected language, and the date and time of the website visitors are among the several pieces of data gathered. It was emphasized in the Guarantee decision that IP address is personal data and that even if it were abbreviated, Google would still be able to read it with other data and capabilities it has. This is why the processing was declared unlawful.

The French DPA (CNIL) released a decision on February 10th, 2022 ordering a French website manager to comply with the General Data Protection Regulation (GDPR) and to discontinue the use of Google Analytics 3.

CNIL has recently published FAQs on the topic. The CNIL posted this document on its site to clear any doubts regarding the decision made on February 10. However, they haven’t added anything new to what has already been announced in the Authority’s decision.

Key points

As far as the FAQs are concerned, there are no particular changes to what the Authority already stated in its decision of 10.2.2022. It is just that the arguments have been reported in a more schematic manner:

👉 the additional measures put in place by Google Analytics 3 are not sufficient to prevent access by US government agencies under the CLOUD Act;

👉 the website operator has one month to discontinue the service and opt for another service that is compliant;

👉 a proxyfication method can be considered, which allows, when properly configured, to send only pseudonymized data to a server located outside the EU.

The Austrian DPA (DSB) published a decision on April 22nd, 2022 in which they found an unnamed EU website operator in violation of Article 44 of the GDPR.

Key Points

👉 The DSB explained that by using Google Analytics 3, the website operator gave Google LLC access to browser information, IP addresses, and unique user identification numbers.

👉 Although the website operator acknowledged that Standard Contractual Clauses (SCCs) had been reached with Google LLC, the DSB determined that these SCCs did not offer an acceptable level of protection in accordance with Article 44 of the GDPR.

👉 The DSB determined that Chapter V of the GDPR could not be implemented when using Google Analytics 3. The website operator had stopped using the tool before the complaint procedure was over, so it was not necessary to use its enforcement powers in this case.

In a press release from the Danish DPA (Datatilsynet), the authority has said,

if you use Google Analytics, you must put in place a plan to bring your use of (Google Analytics) into compliance by implementing supplementary measures.

They mention the use of pseudonymization as one possible technical measure that may be relevant when using Google Analytics. Datatilsynet also points to the guidance created by The French Data Protection Authority for organizations wishing to establish effective pseudonymization by means of a so-called reverse proxy.

Key points

👉 On the basis of the Austrian judgment as well as the other expected decisions regarding the use of Google Analytics, the Danish Data Protection Agency plans to prepare a summary, indicative text.

👉The Datatilsynet emphasized the need for authorities to share a common understanding of the decision because it involves a set of shared European rules.

What is different about Google Analytics 4?

Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some of the concerns.

  • Google Analytics 4 uses IPs at first to decide where to store users’ other personal data (the server or data center depends on the user’s IP). It then eliminates IP addresses completely in an attempt to mitigate the problem of transferring European data to the United States.
  • Google Analytics 4 will also offer country-level controls and customization options to allow you to minimize the collection of user-specific data.

For more detailed information on Google Analytics 4 see here.

What action do I need to take?

As it is still difficult to gauge the impact of the decision on Google Analytics, it is up to each business to decide on which action to take. 
Since the main issue at hand is the transfer of European data to the US and the potential risks involved, in general, it could be a good idea to:

  • switch to a non-US based Analytics company, or
  • if you choose to continue using Google Analytics, you should upgrade to GA4* and implement additional measures using the available settings.

*Please be aware, however, that since the DPA investigations were based on Google Analytics 3, there’s as of yet no way to know definitively if the Authorities will consider the use of GA4 to be enough.

If you choose to continue using Google Analytics, here are a few things you can do to bring you closer to compliance:

  1. You can limit data gathering by using Google’s extensive privacy controls, ranging from restricting advertising features to fully deactivating data collection. 
  2. An internal assessment of Google Analytics can be used to determine whether some or all metrics are appropriate for your company. Google Analytics 4 now provides the option to: turn off the collection of Google Signals data based on geographic area and turn off the collection of granular data on location.
  3. In light of CNIL’s FAQs on this topic, it’s worthwhile mentioning proxy servers. Using a proxy server to avoid direct contact between the user’s computer and Google Analytics might be possible.

FAQs

Data Protection Authorities found that data transfers to the US don’t have the same protection standards as in the EU.

The situation stems from a set of U.S. laws that allow government organizations to request access to consumers’ personal data from US-based services, regardless of where the data centers or servers are located.

In light of this, NOYB filed 101 complaints with European DPAs to find that transferring European users’ data to the U.S. was unlawful. The decisions, which have noted the illegitimacy of the transfers, focus on the analysis of additional technical, contractual and organizational measures.

The use of an encryption key by the company in question was deemed insufficient as the key was owned by Google LLC. From this, it follows that as long as the encryption key remains accessible to the importer (in this case, Google Analytics), the measures taken cannot be considered appropriate.

Furthermore, contractual and organizational measures are not evaluated because the others are always considered insufficient if technical measures are missing.

Based on the decisions issued so far, we can assume that the possible legal consequences are as follows:

  1. Receiving an order to identify additional technical measures within 60 (CNIL) or 90 days (Garante).
  2. Receiving an order to discontinue the service and replace it with another.

Please note that to date, no economic sanctions are being issued for the use of Google Analytics.

*As always, we’re following this evolving case and will keep this post updated with the latest developments. Bookmark this post to make sure that you don’t miss an update!