Is Google Analytics Illegal? Part Deux

Is Google Analytics Illegal? Part Deux
Estimated Reading Time: 5 minutes

**Important – This is not legal counsel, the materials provided are for informational purposes only and not for the purpose of providing legal advice. Final decisions must be made by your own legal representation.**

A couple of weeks ago, we discussed the implications and recommendations following the Austrian DPA’s released opinion that the use of Google Analytics (GA) was illegal in the context of a complaint filed in September of 2020. The question of “does the use of GA violate General Data Protection Regulation (GDPR)?” at the time had a bit of a complicated answer. Much of this murkiness has been cleared up due to the recent release by France’s CNIL which very clearly states that the use of GA in its current form is a violation of GDPR.

The CNIL’s statement is in response to their review of similar complaints to those from the Austrian case. Specifically at question are the protections in place for personal data by GA as it relates to international transfers. It is the opinion of both the Austrian and French DPA that the protections in place are not sufficient to satisfy the requirements of Article 44 of GDPR. Therefore, the use of GA is a violation. 

How does this differ from the Austrian opinion?

The Austrian DPA’s opinion issued spoke to a specific set of circumstances and configuration of GA. The circumstances considered in that case were also from September 2020—some of the nuance had changed in the past two years. France’s CNIL statement is based upon a current review of GA and the protections in place for the international transfer of French user’s personal data. The statement is not in reference to a specific set of configurations but rather default, always-happening behavior of GA. This makes the opinion much more broad in applicability and explicit in its position.

So, what is specifically at issue?

Specifically cited in both of these instances is the international transfer of personal data by GA not having sufficient protections to satisfy GDPR requirements. The CNIL has issued the opinion that any unique identifier for a user would fall under this definition of “personal data” and therefore would put GA in scope of GDPR. GA, by default, will always send at minimum a client ID and the IP address of the user. The client ID is a unique identifier specific to a user on a specific domain. The IP address, while potentially obfuscated based upon settings applied, is still collected and initially processed. Due to Google’s storage of GA data in the United States, and no satisfactory lawful transfer agreement in place following the invalidation of the EU-US Privacy Shield in 2020, this architecture violates GDPR. This is regardless of any additional configuration a business may have which could also put GA data in scope of GDPR (such as a user ID). 

What next?

Absent a major architectural change from Google (which has been hinted at), this is the second EU market to explicitly state the usage of GA is illegal. Considering the issues at question, more EU DPAs are likely to follow suit. Unless Google provides a technical mechanism to either not collect any personal data (therefore removing GA from the scope of GDPR—also significantly reducing the use cases which GA could address) or to process and store data collected from EU users only in the EU, the usage of GA would present a compliance risk for organizations using the platform.

Anything else relevant to know?

In the background, there are ongoing discussions between US and EU regulators on the creation of a new standard legal mechanism organizations could use to certify international data transfers to replace the EU-US Privacy Shield. Just last week Google and Meta issued some strong statements in response to similar issues. With the vast business implications of the impact of not just being able to use GA but also any platform which stores or processes personal data in the United States, regulators should be very motivated to get something in place. We will see over the coming months if this motivation brings about a new standard transfer agreement.

We said “more to come” in response to the Austrian DPA’s opinion, this is certain to be just one of the first of many additional opinions from EU DPAs that will be made on this topic in the coming weeks. Stay tuned as the plot continues to thicken.

Interested in discussing a privacy-centric first party data strategy?

We’d love to chat. Reach out to our team of data governance experts!
Facebook
Twitter
LinkedIn
Email
Last Updated: February 11, 2022

Other Articles You Will Enjoy

Creating Goals in Google Analytics 4: What’s New?

Creating Goals in Google Analytics 4: What’s New?

Google Analytics, which is arguably one of the most important and widely used web and app analytics tools, saw the release of its latest…

5-minute read
Recreating Core Universal Analytics Reports in Google Analytics 4: Top Audience Reports

Recreating Core Universal Analytics Reports in Google Analytics 4: Top Audience Reports

Introduction As the martech world begins preparing for our cookieless, privacy-centric future, Google has responded with their own platform updates to address consumer concerns…

5-minute read
Recreating Core Universal Analytics Reports in Google Analytics 4: Top Acquisition Reports

Recreating Core Universal Analytics Reports in Google Analytics 4: Top Acquisition Reports

Introduction As the martech world begins preparing for our cookieless, privacy-centric future, Google has responded with their own platform updates to address consumer concerns…

8-minute read
Prepare for the Trek with Your Google Analytics 4 Roadmap

Prepare for the Trek with Your Google Analytics 4 Roadmap

Unless you’ve been living under a rock, you’ve heard the news that Google is deprecating Google Universal Analytics (UA) by July of 2023 (October…

7-minute read
Google Analytics 4 Reporting: Troubleshooting Potential Errors

Google Analytics 4 Reporting: Troubleshooting Potential Errors

How Do I Troubleshoot Potential Errors? Google Analytics 4 (GA4) has made numerous improvements over time. However, with any new tool and releases, we’re…

3-minute read
Google Analytics 4, Privacy Centricity, and Compliance: Aligning Teams

Google Analytics 4, Privacy Centricity, and Compliance: Aligning Teams

As marketers have been challenged to ensure the transition to durability is pacing with the depreciation of Universal Analytics, the best-in-class realize that these…

3-minute read
How to Prepare Your Analytics for a Prosperous Holiday Season

How to Prepare Your Analytics for a Prosperous Holiday Season

For retailers, the holiday season is make-or-break. This time of year can account for a significant portion of annual sales, so it’s crucial that…

8-minute read
Privacy-Centric Google Analytics 4: Consent and Opt-Out Configuration

Privacy-Centric Google Analytics 4: Consent and Opt-Out Configuration

Configuration requirements for data collection have never been more confusing. Differing EU laws, patchwork privacy in the United States, differing feature support based upon…

12-minute read
Firebase Tools & Features: Cloud Messaging

Firebase Tools & Features: Cloud Messaging

What Is Firebase? Firebase is Google’s Backend-as-a-Service (Baas) solution for mobile app development. Originally it was developed and launched in 2011 by Firebase Inc,…

5-minute read

Get Your Assessment

Thank you! We will be in touch with your results soon.
{{ field.placeholder }}
{{ option.name }}

Talk To Us

Talk To Us

Receive Book Updates

Fill out this form to receive email announcements about Crawl, Walk, Run: Advancing Analytics Maturity with Google Marketing Platform. This includes pre-sale dates, official publishing dates, and more.

Search InfoTrust

Leave Us A Review

Leave a review and let us know how we’re doing. Only actual clients, please.