Compliance of transfers to Google Analytics in the USA

Following complaints from NOYB, the Austrian DSB and then the CNIL, in cooperation with its European counterparts, have in turn analyzed the transfers of data collected by Google Analytics to the United States.
     
Following a similar reasoning, these Supervisory Authorities considered, respectively on January 12, 2022 and February 10, 2022, that these transfers are illegal.
     
To begin with, it should be noted that only the publisher who uses Google Analytics is affected by these decisions: Google is not called into question by these Authorities in the specific context of this transfer.
     
Indeed, in the case of a transfer outside the European Economic Area (“EEA”), only the transmission of personal data by the exporter is covered by the notion of transfer within the meaning of the GDPR, and not its receipt by the importer.
     
Find the detailed explanation of these decisions below, or jump directly to sections III and IV to find out how to bring this transfer into compliance with the GDPR.