Google Analytics considered... illegal?

19th of January, 2022

Some time ago I wrote a short post about my my feelings towards web analytics which were sparked due to a spike in visitors on my site (mainly coming from Hacker News). Due to that surge, I decided to part ways completely from any sort of tracking, since for me it was mainly a unnecessary dopamine fix rather than anything useful.

Today I stumbled upon big news on the front of legitimacy of web analytics from the point of view of privacy. Turns out, as most suspected, it's not so good, at least according to Austria's data protection authority.

Basically this case dates back to invalidation of Privacy Shield data sharing system between the EU and the US, because of overreaching US surveillance. Turns out that many companies in US have largely ignored this invalidation, which happened in 2020, and despite this they have still continued to transfer data from EU to US. The Austrian DPA held that the use of Google Analytics by an Austrian website provider led to transfers of personal data to Google LLC in the U.S. in violation of Chapter V. of the GDPR.

Future of Google Analytics in EU

In the long run, there will be two options: Either the US changes its surveillance laws to strengthen their tech businesses, or US providers will have to host data of European users in Europe. This kind of transcontinental transfer is currently (as the time of writing this) only illegal Austria, but Dutch's DPA (data protection authority) has stated that Google Analytics "may may soon no longer be allowed".

Any case, this is great thing for privacy in EU and hopefully many more countries would join Austria in this effort. You can follow what countries have started to follow this at Is Google Analytics ILLEGAL in your country?

If you have any questions or suggestions, write to topi at topikettunen dot com.

Tags: analytics, computers, gdpr, privacy