Compliance of transfers to Google Analytics in the USA

Following complaints from NOYB, the Austrian DSB and then the CNIL, in cooperation with its European counterparts, have in turn analyzed the transfers of data collected by Google Analytics to the United States.
     
Following a similar reasoning, these Supervisory Authorities considered, respectively on January 12, 2022 and February 10, 2022, that these transfers are illegal.
     
To begin with, it should be noted that only the publisher who uses Google Analytics is affected by these decisions: Google is not called into question by these Authorities in the specific context of this transfer.
     
Indeed, in the case of a transfer outside the European Economic Area (“EEA”), only the transmission of personal data by the exporter is covered by the notion of transfer within the meaning of the GDPR, and not its receipt by the importer.
     
Find the detailed explanation of these decisions below, or jump directly to sections III and IV to find out how to bring this transfer into compliance with the GDPR.

Landmarks


  • I use Google Analytics (Universal Analytics or GA4), am I affected by the CNIL's decision? Yes.
  • I have activated Google Consent Mode, am I protected from the CNIL's decision? No.
  • Can I continue to use Google Analytics as is? No.
  • Can I continue to use GA4 if I activate the Sirdata Analytics Helper service? No.
  • Can I continue to use Universal Analytics if I activate the Sirdata Analytics Helper service? Yes.
  • Can I activate Sirdata Analytics Helper with another CMP than Sirdata? Yes.
     
(Contact us for more information if you are concerned)