Is Google Analytics Illegal? Part Deux

Is Google Analytics Illegal? Part Deux
Estimated Reading Time: 5 minutes

**Important – This is not legal counsel, the materials provided are for informational purposes only and not for the purpose of providing legal advice. Final decisions must be made by your own legal representation.**

A couple of weeks ago, we discussed the implications and recommendations following the Austrian DPA’s released opinion that the use of Google Analytics (GA) was illegal in the context of a complaint filed in September of 2020. The question of “does the use of GA violate General Data Protection Regulation (GDPR)?” at the time had a bit of a complicated answer. Much of this murkiness has been cleared up due to the recent release by France’s CNIL which very clearly states that the use of GA in its current form is a violation of GDPR.

The CNIL’s statement is in response to their review of similar complaints to those from the Austrian case. Specifically at question are the protections in place for personal data by GA as it relates to international transfers. It is the opinion of both the Austrian and French DPA that the protections in place are not sufficient to satisfy the requirements of Article 44 of GDPR. Therefore, the use of GA is a violation. 

How does this differ from the Austrian opinion?

The Austrian DPA’s opinion issued spoke to a specific set of circumstances and configuration of GA. The circumstances considered in that case were also from September 2020—some of the nuance had changed in the past two years. France’s CNIL statement is based upon a current review of GA and the protections in place for the international transfer of French user’s personal data. The statement is not in reference to a specific set of configurations but rather default, always-happening behavior of GA. This makes the opinion much more broad in applicability and explicit in its position.

So, what is specifically at issue?

Specifically cited in both of these instances is the international transfer of personal data by GA not having sufficient protections to satisfy GDPR requirements. The CNIL has issued the opinion that any unique identifier for a user would fall under this definition of “personal data” and therefore would put GA in scope of GDPR. GA, by default, will always send at minimum a client ID and the IP address of the user. The client ID is a unique identifier specific to a user on a specific domain. The IP address, while potentially obfuscated based upon settings applied, is still collected and initially processed. Due to Google’s storage of GA data in the United States, and no satisfactory lawful transfer agreement in place following the invalidation of the EU-US Privacy Shield in 2020, this architecture violates GDPR. This is regardless of any additional configuration a business may have which could also put GA data in scope of GDPR (such as a user ID). 

What next?

Absent a major architectural change from Google (which has been hinted at), this is the second EU market to explicitly state the usage of GA is illegal. Considering the issues at question, more EU DPAs are likely to follow suit. Unless Google provides a technical mechanism to either not collect any personal data (therefore removing GA from the scope of GDPR—also significantly reducing the use cases which GA could address) or to process and store data collected from EU users only in the EU, the usage of GA would present a compliance risk for organizations using the platform.

Anything else relevant to know?

In the background, there are ongoing discussions between US and EU regulators on the creation of a new standard legal mechanism organizations could use to certify international data transfers to replace the EU-US Privacy Shield. Just last week Google and Meta issued some strong statements in response to similar issues. With the vast business implications of the impact of not just being able to use GA but also any platform which stores or processes personal data in the United States, regulators should be very motivated to get something in place. We will see over the coming months if this motivation brings about a new standard transfer agreement.

We said “more to come” in response to the Austrian DPA’s opinion, this is certain to be just one of the first of many additional opinions from EU DPAs that will be made on this topic in the coming weeks. Stay tuned as the plot continues to thicken.

Interested in discussing a privacy-centric first party data strategy?

We’d love to chat. Reach out to our team of data governance experts!
Facebook
Twitter
LinkedIn
Email
Last Updated: January 17, 2023

Other Articles You Will Enjoy

Four A/B Testing Platforms to Consider When Planning for the Sunset of Google Optimize

Four A/B Testing Platforms to Consider When Planning for the Sunset of Google Optimize

Google recently announced that both Google Optimize and the Google Optimize integration with Google Analytics 4 (GA4) will sunset on September 30, 2023. After…

11-minute read
Google Analytics 4 Filters: The Good, the Bad, and the Unpleasant

Google Analytics 4 Filters: The Good, the Bad, and the Unpleasant

Google Analytics 4 (GA4) filtering when compared to Universal Analytics (UA) is clearly more restrictive. Gone are the days of filtering by URL string….

5-minute read
Google Analytics Consent Mode | A Conceptual Review

Google Analytics Consent Mode | A Conceptual Review

Introduction Google Analytics Consent Mode is a new functionality for Google Analytics 4 (GA4) that provides a solution for the challenge of reporting user…

4-minute read
Comparing Five Google Analytics Alternatives for Europe

Comparing Five Google Analytics Alternatives for Europe

EU Country Rulings Multiple data protection authorities across Europe have released unfavorable findings against Google Analytics (GA), including the latest iteration of Google Analytics…

7-minute read
What Happened to Views and Filters in Google Analytics 4?

What Happened to Views and Filters in Google Analytics 4?

For years, Google Analytics has been known for its simple hierarchy of Account > Property > View. If you took a Google Analytics Academy…

10-minute read
DebugView in Google Analytics 4: How Does It Work?

DebugView in Google Analytics 4: How Does It Work?

Google Analytics 4 (GA4) offers a lot of new features as compared to Universal Analytics. One of the new additions in GA4 is DebugView…

9-minute read
Google Signals in Google Analytics 4 and How It Impacts Your Audience Strategy

Google Signals in Google Analytics 4 and How It Impacts Your Audience Strategy

About Google Signals Google Signals is an analytics feature provided by Google that enables cross-device reporting and remarketing. Integrated with Google Analytics, Signals helps…

9-minute read
What Will Happen If My Org Doesn’t Migrate to Google Analytics 4?

What Will Happen If My Org Doesn’t Migrate to Google Analytics 4?

Introduction You have probably heard about the sunsetting of Universal Analytics (UA) and the push towards Google Analytics 4 (GA4). At InfoTrust, we strongly…

3-minute read
How To Fix Multiple Payment Method Issues In Google Analytics

How To Fix Multiple Payment Method Issues In Google Analytics

Most online businesses, including eCommerce, accept payment online using multiple payment methods. These payment methods may include PayPal, card payment, Stripe, etc. This is…

5-minute read

Get Your Assessment

Thank you! We will be in touch with your results soon.
{{ field.placeholder }}
{{ option.name }}

Talk To Us

Talk To Us

Receive Book Updates

Fill out this form to receive email announcements about Crawl, Walk, Run: Advancing Analytics Maturity with Google Marketing Platform. This includes pre-sale dates, official publishing dates, and more.

Search InfoTrust

Leave Us A Review

Leave a review and let us know how we’re doing. Only actual clients, please.