**Important – This is not legal counsel, the materials provided are for informational purposes only and not for the purpose of providing legal advice. Final decisions must be made by your own legal representation.**
A couple of weeks ago, we discussed the implications and recommendations following the Austrian DPA’s released opinion that the use of Google Analytics (GA) was illegal in the context of a complaint filed in September of 2020. The question of “does the use of GA violate General Data Protection Regulation (GDPR)?” at the time had a bit of a complicated answer. Much of this murkiness has been cleared up due to the recent release by France’s CNIL which very clearly states that the use of GA in its current form is a violation of GDPR.
The CNIL’s statement is in response to their review of similar complaints to those from the Austrian case. Specifically at question are the protections in place for personal data by GA as it relates to international transfers. It is the opinion of both the Austrian and French DPA that the protections in place are not sufficient to satisfy the requirements of Article 44 of GDPR. Therefore, the use of GA is a violation.
How does this differ from the Austrian opinion?
The Austrian DPA’s opinion issued spoke to a specific set of circumstances and configuration of GA. The circumstances considered in that case were also from September 2020—some of the nuance had changed in the past two years. France’s CNIL statement is based upon a current review of GA and the protections in place for the international transfer of French user’s personal data. The statement is not in reference to a specific set of configurations but rather default, always-happening behavior of GA. This makes the opinion much more broad in applicability and explicit in its position.
So, what is specifically at issue?
Specifically cited in both of these instances is the international transfer of personal data by GA not having sufficient protections to satisfy GDPR requirements. The CNIL has issued the opinion that any unique identifier for a user would fall under this definition of “personal data” and therefore would put GA in scope of GDPR. GA, by default, will always send at minimum a client ID and the IP address of the user. The client ID is a unique identifier specific to a user on a specific domain. The IP address, while potentially obfuscated based upon settings applied, is still collected and initially processed. Due to Google’s storage of GA data in the United States, and no satisfactory lawful transfer agreement in place following the invalidation of the EU-US Privacy Shield in 2020, this architecture violates GDPR. This is regardless of any additional configuration a business may have which could also put GA data in scope of GDPR (such as a user ID).
What next?
Absent a major architectural change from Google (which has been hinted at), this is the second EU market to explicitly state the usage of GA is illegal. Considering the issues at question, more EU DPAs are likely to follow suit. Unless Google provides a technical mechanism to either not collect any personal data (therefore removing GA from the scope of GDPR—also significantly reducing the use cases which GA could address) or to process and store data collected from EU users only in the EU, the usage of GA would present a compliance risk for organizations using the platform.
Anything else relevant to know?
In the background, there are ongoing discussions between US and EU regulators on the creation of a new standard legal mechanism organizations could use to certify international data transfers to replace the EU-US Privacy Shield. Just last week Google and Meta issued some strong statements in response to similar issues. With the vast business implications of the impact of not just being able to use GA but also any platform which stores or processes personal data in the United States, regulators should be very motivated to get something in place. We will see over the coming months if this motivation brings about a new standard transfer agreement.
We said “more to come” in response to the Austrian DPA’s opinion, this is certain to be just one of the first of many additional opinions from EU DPAs that will be made on this topic in the coming weeks. Stay tuned as the plot continues to thicken.
