The future of Google Analytics in the EU remains in question. The Commission Nationale de Línformatique et des Libertés or CNIL, the French data protection body, has decided and announced that the use of Google Analytics is in breach of the General Data Protection Regulation ().
The French data protection commission joins Austria and considers the use of Google Analytics illegal in the EU
Specifically, the one that “In cooperation with its European counterparts, it analyzed the conditions under which the data collected through this tool is transferred to the United States”, coming to the conclusion that such transfers are illegal, therefore «French webmasters are required to comply with the GDPR and if necessary, stop using this tool under current conditions”. French web administrators notified for the use of this tool will have one month to comply with this new rule.
A decision that will not only affect Google
In 2020 the Court of Justice of the European Union (CJEU) declared the 2016 Privacy Shield agreement between the European Union and the United States invalidruling that the use of US providers, such as Google Analytics, violates the RGPD since US companies are required by law to share their content with the authorities in this country, which allows access to the data of European users.
Of course international data transfer affects all US tech giants that provide their services in Europe. It is for this reason that Meta has again threatened if regulators prevent the transfer of its users’ personal data to the United States.
In the specific case of Google Analytics in the EU, just a few weeks ago the Austrian data protection agency (DSB), found that the data it shared with the US included users’ personal data, so it was possible to identify a visitor.
Now the French CNIL that currently these data transfers between the US with Google Analytics are not sufficiently regulated, and that despite the fact that Google “has taken additional measures to regulate data transfers within the framework of the functionality of Google Analytics, these are not sufficient to exclude the possibility of US intelligence services accessing this data.”
Recall that in the Austrian case, the regulatory body explained that the IP address as well as the identifiers in the data include data of visitors to a website, which means that these transfers fall under the scope of the application of the law of EU data protection.
Speaking of the specific case of Google Analytics, it was noted that an IP address “anonymization” function had not been properly implemented on the website, but independent of this technical issue, the regulator found that IP address data being shared to the US included users’ personal data, so it was possible to identify a visitor.
“United States intelligence services use certain online identifiers (such as IP address or unique identification numbers) as a starting point for surveillance of individuals”assured the Austrian regulator
Google’s response to the Austrian authority
At the moment Google has not responded to this case, but in the case of Austria, the internet giant focused on six aspects that it considers essential to defend its activity against that resolution:
- Google Analytics is a service organizations use to understand how their sites and apps are used so they can make them work better. It does not track people or profile people over the Internet.
- Organizations control the data they collect through Google Analytics.
- Google Analytics helps customers with compliance by providing a variety of controls and resources.
- Google Analytics helps users control their data.
- Google Analytics cannot be used to show ads to people based on sensitive information such as health, ethnicity, sexual orientation, etc.
- An organization’s Google Analytics data can only be transferred when specific and rigorous privacy conditions are met. Google Analytics operates data centers around the world, including in the United States, to maximize the speed and reliability of the service. Before data is transferred to any servers in the United States, it is collected on local servers, where users’ IP addresses are anonymized (when customers enable the feature).The GDPR and the Court of Justice of the EU say that data can be transferred outside the European Union only for these types of reasons, as long as the conditions are met.
Of course, this is a very important decision since the future of Google Analytics in the EU is very uncertain. And while there are many, Google Analytics is the most widely used analytics tool.
Image:
Stay informed of the most relevant news on our news channel
Facebook Comments
Disqus