EU Regulators Find Google Analytics Data Transfers to the US Unlawful

Italian, French and Austrian data protection authorities found that the Google Analytics deployments they examined unlawfully transferred European website users’ personal data to the United States without adequate safeguards. The decisions followed complaints by privacy group noyb and applied the EU Court of Justice’s Schrems II ruling, which invalidated Privacy Shield. France’s CNIL ordered three website operators to bring their processing into GDPR compliance, while Italy’s Garante joined the findings against the examined transfers. Regulators concluded that Google’s safeguards did not adequately protect the data against access by US intelligence agencies.

Austria’s DSB also rejected a proposed risk-based approach to international transfers and found IP anonymization insufficient because it occurred after transfer to Google and left other identifiers unaffected; Italy likewise rejected IP anonymization as an adequate safeguard. The findings underscore that contractual clauses and technical measures must provide effective protection, rather than merely reduce the perceived likelihood of surveillance. Enforcement outcomes differed: Spanish and Luxembourg authorities closed some complaints after operators removed Google Analytics or Facebook tools, without deciding whether earlier transfers were lawful. These were case-specific findings, not evidence of a current EU-wide ban; organizations should assess their analytics deployments against applicable transfer rules and verify that safeguards address access risks.