33 ms·
Is Google Analytics Banned in the EU? – TLDR
Finland is the latest EU country to crack down on Google Analytics. So again the question arises: Do you really need to get rid of GA in the EU?
(Full disclosure. I'm the founder of Simple Analytics. A privacy-friendly GA alternative). I intend not to advocate for you to switch or pitch my product. (Heck, please stay away from it if you love tracking every move someone makes on your website).
I want to give you an update on the EU stance toward GA. As people are raising questions, and the legislation is quite fuzzy.
Is GA illegal in the EU? No, it is not yet, in theory, however, in practice, it is. Let me explain: A few EU countries (Italy, Austria, Finland, Denmark, and France) have fined specific cases for using GA. So there is not a nationwide ban. However, these cases set a precedent. In theory, other companies might employ better safeguards than the specific cases and be safe, but this is in practice impossible.
Is every EU country for themselves? No. It seems that EU countries independently issue press releases and work on their own cases, but the EPDB has created an overarching task force to make this an EU-wide matter. So the fact that France banned a specific case from using GA, makes it very likely the Spanish or Dutch privacy authority thinks the same.
What was the problem again? The problem is the data transfers to the US. The GDPR is founded to protect EU citizens. After the Snowden revelations, noyb (a privacy NGO) argued that EU citizens' data is not protected enough when transferred to the US. Noyb won the court battle, and this issue is still the case now. Google is a US-based company that transfers data to the US. They do have an EU entity in Ireland, but this does not prevent all this. This is why Google Analytics is unlawful.
What is the solution? The US needs new legislation in place to protect EU data. The first steps are being made, the EU and the US negotiated a new data transfer agreement called Trans Atlantic Privacy Framework. US President Joe Biden signed an executive order to make the framework possible.
When can we expect a solution? This will take a while. The upcoming framework will certainly be challenged before the Court of Justice of the EU by noyb again. They already stated they are going to do this. It's difficult to say how this will play out.
In conclusion, in theory, there is not an EU-wide ban on GA. However, in practice, using GA does not comply with GPDR law.
Free feel to drop your questions or reach out to me: @ AdriaanvRossum on Twitter.
- ThePhysicist 4y agoIn fact, the way that most of the privacy-friendly analytics tools advertise their services isn't compliant with GDPR either, as there's a broad consensus that third-party based analytics (even without cookies) cannot be enabled solely based on legitimate interest [1]. Nothing against your service or the myriad other privacy-friendly analytics services, which arguably are more privacy-friendly than Google Analytics, I wouldn't take legal advice from them though as clearly they're often interpreting legislation generously in their favor as well. Unfortunately we're long past the point where people can rely on any vendor being factually correct, it's just about who can shout their truth the loudest (which is bad for publishers as they might be the ones getting fined for relying on these claims). 1: https://www.degruyter.com/document/doi/10.1515/icom-2020-0004/html?lang=en https://www.degruyter.com/document/doi/10.1515/icom-2020-000...
- gardenhedge 4y agoso what about an Italian person visiting a Portuguese website that uses GA. What is the legality there?
- WirelessGigabit 4y agoWhere is the Italian person? Here's another weird one: US websites blocking access to European visitors because of GDPR. But how does the EU have jurisdiction over a server that's hosted in the USA?
- fandorin 4y agoit doesn’t matter, data goes to GA servers in the US anyway