[article published in February 2022 - updated on April 4, 2023]
The Soledis teams are on the lookout: a news item has been shaking up the webmarketing world since early 2022. Will Google Analytics be banned in Europe? Is our data in danger? Should we change our tracking tool today? What are the consequences?
We take stock of this hot topic!
A reminder of the facts
- On July 16, 2020, the Court of Justice of the European Union (CJEU) published the Schrems II ruling which invalidates the Privacy Shieldconsidering that there is a risk that American intelligence services could access personal data transferred to the United States (due to the FISA law and practices already known to the NSA), if these transfers are not properly supervised. This is contrary to European regulations RGPD.
- Since then, the EU and the US have committed to finding an agreement to regulate these data transfers.
List of French websites targeted by a complaint from the NOYB association for data transfers to the U.S. (source: NOYB website) - In the months that followed, the NOYB "My Privacy is None of Your Business" has filed 101 complaints in the 27 EU member states concerning data transfers to the USA.
- January 2022, DSB, the Austrian equivalent of CNIL, issues a formal notice of a local web publisher, accusing Google Analytics of not being compatible with the RGPD.
- February 4, 2022, Google responds with a press release by shifting the responsibility to the US government, which has to reach an agreement with the EU on the use of data. Google is also committed to adding parameters enabling customers to further personalize the analytical data collected, in order to achieve compliance.
- On February 10, 2022, it was the turn of France's CNIL to issue a formal notice to a website manager, considering that the use of Google Analytics as illegal. Further convictions elsewhere in Europe are expected to follow. Google has one month to comply.
- On March 25, 2022, the European Commission and the United States announced in a a press release an agreement in principle on a new transatlantic framework for the protection of personal data, which will promote transatlantic data flows and respond to the concerns expressed by European institutions. At this stage, it is only a political declaration and not yet a legal framework, as the European Data Protection Committee (EDPS) points out in its declaration of april 6.
- In June 2022, as Italy pinned Google Analytics and the blogger, David Libeau files a complaint against 42 French media outlets for their use of Google Analytics, CNIL publishes a guide on how to add a proxy the use of Google Analytics to comply with European law.
- September 2022, Denmark also condemns the use of Google Analytics in Europe.
- January 2023, Finland's turn to condemn HELMET network libraries for their use of Google Analytics.
What's next?
- Either replace Universal Analytics with Google Analytics 4 complies with CNIL obligations (this is Google's objective)
- Either Google Analytics is banned in Europe, and local alternatives take its place. Visit CNIL has published a list of alternatives respecting the RGPD, which can therefore dispense with user consent (the famous "do you accept cookies?" widely rejected by Internet users). Soledis also works with Matomoif you choose this alternative recommended by na CNIL.
- If the standoff drags on, it should be noted that the RGPD law provides for a fine of up to 20 million euros or 4% of the guilty company's turnover. For the moment, the CNIL is not in a spirit of condemnation but of warning with a deadline for compliance.
4 links to find out more:
- As is often the case, here's an article from the Abondance blog by Olivier Andrieu that sums up the situation nicely .
- To find out more about Google's point of view, here's an article by Kent Walker, one of the company's executives.
- To fully understand the CNIL's position, we recommend their FAQ on the subject.
- Here's a Tweet thread from @Pixeldetracking that debunks the CNIL's accusation.
Whatever the outcome of Google's relationship with the CNIL, you should know that Soledis' webmarketing teams work with both Google Analytics and Matomo, the alternative recommended by the CNIL, depending on the customer's choice.
