Use Of Google Analytics By EU Websites Violates GDPR

Introduction

On 13 January 2022, the Austrian Data Protection Authority ("DSB") ruled that the use of Google Analytics ("GA") and the resulting export of personal data to the United States ("US") violates the GDPR's data export requirements. On 10 February 2022 the French data protection authority ("CNIL") also confirmed that these personal data transfers to the US are a violation of the GDPR. These are the first decisions from EU data protection authorities ("DPAs") in response to 101 complaints filed by NOYB, a privacy advocacy group, following the Schrems II decision. We expect more decisions in the coming months. If, as is expected, the conclusions in these are similar to those of the DSB and CNIL, US cloud service providers and their EU customers will need to reassess their data export practices.