It was about the use of personal data specifically, not jus tin general a use of US services. From the linked article (which seems to draw some broader fear-mon

It was about the use of personal data specifically, not jus tin general a use of US services. From the linked article (which seems to draw some broader fear-mongering conclusions not evidenced by the case it discusses): It held that the mere use of a U.S.-based provider to collect IP addresses and user key data was an unlawful “transfer” because: Per the Court of Justice of the European Union, IP addresses are personal data (the court also considered Cookiebot’s “user key” to be personal data). Under the Clarifying Lawful Overseas Use of Data Act, a U.S. cloud provider can be obligated to produce all data in its possession, custody, or control to U.S. agencies, irrespective of whether the data is stored in or outside the U.S. This decision has a number of noteworthy implications. Among the more salient are: The court never evaluated whether a “transfer” actually occurred. The decision assumes a “transfer” occurs even if data never leaves the EU, so long as the recipient of data may formally be subject to requests by non-EU authorities.