Many EU companies rely on Google Analytics. Many have forwarded their data to Google, allowing them to be processed in the US.

The trouble is, according to a recent ruling by the Austrian Data Protection Authority ("Datenschutzbehörde"), such a transfer of data violates the General Data Protection Regulation (GDPR). The decision is based on several complaints that the Austrian NGO NOYB (European data protection advocacy group) filed in the wake of the European Court of Justice's "Schrems II" decision. The CJEU ruled that the US-EU data transfer agreement "Privacy Shield" is not in line with EU data protection law and struck down the deal in 2020, which rendered most data transfers to the US illegal.

However, the ruling has been partly ignored by Google. During the proceedings, the tech-giant admitted that "all data collected through Google Analytics [...] is hosted (i.e. stored and further processed) in the USA," which includes European users. The Austrian Data Protection Authority has now ruled that this behavior constitutes a breach of EU law.

The Austrian Data Protection Authority has now decided that the use of Google Analytics violates the General Data Protection Regulation (GDPR). Google also uses a data-tracking cookie, recognized and deactivated by users. Although this does not constitute a violation of the GDPR, it does violate the EU ePrivacy Directive.

This is because users must consent to set cookies, which is not the case here. The authority has given Google three months to change its processes or face fines.
Because Google is an international company and many EU companies rely on its services, other European data protection authorities will likely follow suit and take similar action against Google. The EU's Data Protection Board, comprised of representatives from all European DPAs, cooperates with NOYB to investigate Google. They have created a task force to examine whether Google's data-tracking practices breach EU law.

What does this mean for other Google Services?
Google is massive, now we have seen Google Analytics being targeted.

How about the other solutions such as maps and search consoles and merely important for many people, what would be the impact for YouTube? It's clear that the outcome of this ruling could have a deep impact on the way, how the users in Europe are consuming the Google Services. This ruling also provide two side-effects.

1. Big Tech is no longer out of reach when it comes to user-centralization.
2. This ruling gives European companies the possibility to use the tenor to build their unique selling point as "built and hosted in Europe."

While the majority of companies are also could consider migrating to other analytics solutions such as Plusgrowth Analytics as a Service. If you have any questions, regarding this feel free to contact us.