Sweden Fines Tele2 €1 Million Over Google Analytics Data Transfers to the US

Sweden’s data protection authority, IMY, fined Tele2 SEK 12 million (approximately €1 million) and CDON SEK 300,000 in 2023 over unlawful EU–US personal-data transfers involving Google Analytics. IMY also issued decisions against Coop and Dagens Industri without financial penalties, finding Google’s supplementary safeguards insufficient. Privacy organization noyb described the fines as the first financial penalties for Google Analytics use that breached EU data-transfer requirements. The decisions followed its 101 complaints filed in 2020 after the Court of Justice of the European Union’s Schrems II ruling invalidated Privacy Shield.

The Swedish enforcement followed adverse findings on Google Analytics transfers by authorities in Austria, France and Italy. Austria rejected a risk-based justification and found that IP anonymisation occurred only after data reached Google, leaving cookie identifiers and device data unprotected. France ordered three website operators to bring their use into compliance. Austria also found that Meta’s Facebook tracking pixel violated international-transfer requirements; no penalty was confirmed in that report. Although the European Data Protection Board established a coordinating task force, national approaches differed: Spain and Luxembourg closed some complaints after websites removed the tools, without deciding whether earlier transfers were unlawful. These historical decisions underscore the need to assess analytics and tracking data flows, applicable transfer mechanisms and safeguards rather than assume contractual clauses or IP anonymisation alone establish compliance.