French Sites Are Ordered to Stop Using Google Analytics

Last week, the French data watchdog—Commission Nationale de l’informatique et des libertés (CNIL)—ordered three French websites to stop using audience analytics site Google Analytics, deeming the site to be illegal under the General Data Protection Regulation. The websites have 30 days to comply or risk hefty fines up to €20 million, or 4% of the annual turnover. The warning came after the French watchdog received several complaints concerning data transfer between the U.S. and European Union by the European Center for Digital Rights (NOYB) in 2020, a nonprofit chaired by privacy activist Max Schrems. NYOB sent these complaints to several regional Data Protection Authorities (DPAs), including the Austrian and French DPAs. The French watchdog has been contacted for a response. “About half the complaints target the use of Google Analytics, the other half target the use of Facebook Connect,” said Gabriela Zanfir-Fortuna, vp for global privacy at the Future of Privacy Forum, a nonprofit organization that provides privacy protection solutions. How Agencies Are Helping Brands Quit Cookies Countless sites rely on Google Analytics to learn more about their audience. As privacy laws tighten, especially in Europe, and a solid framework for transatlantic data flow is still being thrashed out, the number of services flouting GDPR will come to light. The concern, in a global economy, is a future with separate products for the EU and the U.S. Per the 2016 guidelines by the European Data Protection Supervisor (EDPS), “tracking cookies, such as the Stripe and Google Analytics cookies, are considered personal data, even if the traditional identity parameters of the tracked users are unknown or have been deleted by the tracker after collection.” This means that companies based in Europe using Google Analytics—which reads cookies that are dropped on peoples' browsers when they visit a site to gauge whether they are a new or returning user—were shipping people’s personal information to the U.S. Insufficient supplemental measures under Schrems II Companies in the EU that transfer data to the U.S. are mandated to comply with the "supplemental measures," which are supposed to encourage tighter data security, preventing the possibility of surveillance, under the Schrems II judgment, the guidelines set in 2020 after the previous transatlantic data deal was overturned by its namesake. An example of this measure could be a clause that lets companies in the EU challenge every data access requested by the U.S. government. Or, the measure could also be more technical in nature, like encryption deployment, so no one has access to it. The DPAs evaluated the efficacy of these supplemental measures and concluded the measures currently being used are not sufficient at protecting data privacy, said Zanfir-Fortuna. “That’s why they find the data transfer is unlawful,” she added. As a result, the first decision was issued by the Austrian DPA earlier in January, followed by the decision by CNIL in early February. A domino effect Similar decisions—cracking down on unlawful personal data transfer between the U.S. and EU—by DPAs across Europe, including Germany, Spain, Portugal, and Poland, are expected in the following months. “If the authorities find that data transfer does not have sufficient safeguards in place, its de facto means companies must stop using Google Analytics,” said Zanfir-Fortuna. Although the U.S government and the European Commission announced a political agreement recently, until a lawful framework that shepherds the transatlantic data flow comes in, DPAs are “obligated by law to solve each of these complaints,” she added. These decisions will not be limited to Google Analytics, but any data transfer, such as cloud services, between the regions. "In the long run, we either need proper protections in the U.S., or we will end up with separate products for the U.S. and the EU," said chair of NYOB Schrems. "I would personally prefer better protections in the U.S., but this is up to the U.S. legislator, not to anyone in Europe."

Platforms

French Sites Ordered to Stop Using Google Analytics Is Just the Beginning

The websites have 30 days to comply or risk hefty fines up to €20 million

Trishla Ostwal

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Trishla Ostwal