The French privacy and data authority (CNIL) is using Google Analytics as an argument to accuse several French sites of privacy violations. In doing so, the CNIL follows the example of Dutch, Norwegian and Austrian authorities.
“Google’s measures are not sufficient to exclude the accessibility of this data to US intelligence services”, the CNIL stated. The authority has required several French users of Google Analytics to adjust their policies within a month.
Google has been under European fire since the end of 2021. The domino effect began in Austria, where the national data and privacy authority successfully convicted a company of privacy violations due to Google Analytics.
Not long after, the AP (Dutch authority) announced that Google Analytics “may no longer be allowed in the near future”. Authorities in Norway backed Austria and the Netherlands. France’s CNIL is following suit.
Is Google Analytics illegal?
When running a website and using the default settings of Google Analytics, you’re permitting Google to store European personal data in the US.
US intelligence agencies have a legal right to access data in the US. On the other hand, European laws state that no third party can review European personal data, regardless of whether that data is stored outside the EU.
As a result, Google Analytics’ default settings can violate the GDPR.
Google provides Analytics users with settings that anonymize personal data. Upon activation, data is processed in line with European and US laws.
The problem is that Google sees no way to enable the settings by default. That could cause problems with US law. The organization is under pressure from two continents.
The long game
European authorities have no way of dealing with Google directly. The responsibility for data processing lies with users of Analytics.
However, European authorities can impose mild penalties on users to gradually make the software less popular. That’s exactly how the French CNIL, Dutch AP and other authorities are tackling the matter.
Using Google Analytics is not necessarily illegal. To be on the safe side, follow the advice of your national privacy and data authority.