Will Google Analytics be banned soon? These are the facts.

Tuesday 18 January 2022 - Adwise Data

You are currently viewing an older story. The content can be outdated. View our latest stories here

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has indicated that it is investigating whether Google Analytics is in breach of the GDPR and therefore "may soon no longer be permitted". This does raise certain questions.

After further investigation, we can draw the following substantive conclusions:

The underlying argument in this report is that IP addresses and cookie data are covered by personal data, the Austrian data protection regulator concluded. This data is sent to US servers and therefore it is theoretically possible for the US government, for example, to have access to this data.
Many messages that appear on your screen now aimed at “clickbait titles” such as Analytics will be prohibited. However, we do not expect this to happen anytime soon. For example, Google could come up with an update that makes it possible to choose where the data is stored (in the EU, for example). We expect that other options will be considered first instead of GA being banned. Another option is to amend US legislation to protect the privacy of EU citizens in the US. This could be an interesting test of strength between the USA and the EU.
There is another, potentially much greater challenge that comes with this ruling. Let's go back to the first point above: it has been stipulated that IP addresses and cookies data may not be sent to the USA without permission. That's not just a problem for Google, it's a problem for everything hosted in the US. Without going into too much technical detail; if you visit a European website where something, no matter what (an image, a script) is loaded from the USA, then the server needs to see which computer wants this data. And the server also receives the IP address, cookies, user agent, etc. That's how the internet works. This lawsuit affects not only Google, but actually every 3rd-party source hosted in the USA and loaded by an EU site without the user's permission. Due to the potential impact of this decision, we expect a solution to be found in the short term by the American companies or the European and/or American government.

We will keep a close eye on how this pans out. Websites can switch to alternatives that are hosted in the EU or server side tagging must be used much more extensively. We currently see no reason to panic or to take action. Should this be the case, we will of course notify our clients.

We're not lawyers. These conclusions are drawn based on recent reports.

Source 1: Is Google Analytics illegal?
Source 2: The Register
Source 3: Google Analytics verboden? AP doet onderzoek
Source 4: Austrian DSB: Use of Google Analytics violates "Schrems ||" decision by CJEU.
Source 5: Some facts about Google Analytics data privacy (Google)