Why Google Analytics Is Declared Illegal in Europe: GDPR Implications

Google Analytics (https://analytics.google.com/), known in Chinese as 谷歌分析, is a website analytics tool launched by Google in November 2005.

Google did not develop it from scratch; it acquired Urchin Software Corporation in 2005, whose product became the predecessor of Google Analytics. After the acquisition, the product was renamed from "Urchin from Google" to Google Analytics.

Google Analytics Declared Illegal in Europe

When the EU‑US Privacy Shield was invalidated in 2020, U.S. internet services operating in Europe could no longer transfer European citizens' data to the United States, a practice that violates the GDPR.

“Although the Privacy Shield collapse hit the tech industry, U.S. suppliers and EU data‑transfer partners largely ignored the case, relying on so‑called ‘standard contractual clauses’ to continue data flows,” said NOYB.

The Austrian Data Protection Authority has now ruled that using Google Analytics breaches the GDPR because Google can be compelled to disclose European users' data to U.S. intelligence agencies, making trans‑Atlantic data transfers impermissible.

Main Reason

On August 14, 2020, a Google user visited an Austrian health‑related website that employed Google Analytics, transmitting personal data to Google, which could infer the user’s identity. On August 18, the user filed a complaint with the Austrian authority with the help of the data‑protection group NOYB.

The Austrian court subsequently declared this data transfer illegal.

Because of the U.S. CLOUD Act, American authorities can request personal data from Google and other U.S. providers even when they operate outside the United States, such as in Europe.

Consequently, Google cannot meet the GDPR’s Article 44 adequacy requirements, and the standard contractual clauses cited by website operators are ineffective, as recognized by the European Court of Justice in its 2020 Schrems II decision.

The legal assessment of Google Analytics does not hinge on whether U.S. intelligence actually obtains the data, but on the theoretical possibility that Google could merge usage data with personal identifiers, which itself violates the GDPR.

Google users can adjust settings in their accounts to block detailed analysis of their activity on third‑party sites, but the existence of such a feature proves that Google can combine usage data with personal information.

NOYB’s Biggest Victory

This ruling marks one of NOYB’s greatest successes to date. NOYB and Max Schrems welcomed the Austrian court’s decision, noting that companies can no longer rely on U.S. cloud services for European users without facing legal consequences.

Should You Remove Google Analytics?

European companies now must decide whether to remove Google Analytics from their sites to avoid GDPR penalties.

In the long term, either the United States will amend its surveillance laws to accommodate European privacy expectations, or U.S. internet providers will need to establish data centers within Europe to host European users’ data.

The Dutch Data Protection Authority (AP) is updating its guidance on “privacy‑friendly settings” for Google Analytics, and the Associated Press warns that the use of Google Analytics in Europe may soon be prohibited.

Conclusion

While Silicon Valley firms will likely find ways to continue offering services in Europe, European businesses can no longer trust companies that disregard EU privacy legislation and risk massive fines.

As privacy becomes increasingly important worldwide, choosing services that prioritize user privacy is a logical step for any enterprise.