After the Dutch, now the Norwegian data protection authority also joins an earlier decision by Austrian colleagues. According to the letter of the law, Google Analytics would not be legal to use within the European Union.
It looks increasingly likely that Google Analytics in its current form will fall into illegality. The Norwegian Data Protection Authority is warning of this after an investigation of a previously filed complaint. This shows that the data Google Analytics sends to the U.S. falls under the heading of personal data. Exchanging personal data with the U.S. is currently not allowed under European law, putting legitimate use of Analytics at risk.
The Norwegian authorities have not yet made a final decision, but their warning signals their intention to follow their Austrian counterpart s. Those reached the same conclusion in mid-January after investigating a similar complaint.
Anonymous but unique, so still personal
Google Analytics is a popular tool that organizations of all sizes use to monitor their Web sites. Among other things, Analytics shows which pages are popular, how long visitors stay and how often they return. The tool serves not to track users but to optimize Web sites. To that end, it does map the trajectory of visitors and does so through anonymized IDs for users. Because those IDs are unique and generated based on individual characteristics of a visitor, it is theoretically possible to link them to an individual. Therefore, according to applicable European rules, they fall under personal data. In our earlier piece, we go into more detail about the technical and legal background.
read also
Google Analytics illegal across Europe under Austrian GDPR interpretation
In addition to the Norwegian, the Dutch authority already indicated its intention to follow the Austrian reasoning. In principle, local authorities of EU member states are obliged to consult with each other when making decisions. So this comes as no surprise. More member states will follow in the near future as privacy advocacy group Noyb filed about 100 similar complaints spread across most member states. Noyb is the organization of Maximilian Schrems, famous and infamous for the Schrems I and Schrems II rulings that challenged data transfers to the U.S. in the first place.
Huge impact
The decisions of the data protection authorities could have major implications for European Web sites. They are likely to be unable to use Google Analytics in the future. Moreover, the Austrian authority puts the responsibility for the privacy problem on the website publisher and not Google.
For now, it is still drizzling, but the storm is already making itself heard in the distance. Barring any surprises, Google must either adjust how Analytics handles data or organizations across Europe must look for an alternative.