Are the days of Google Analytics numbered?

You see, at the time of writing, Google Analytics doesn't give you the option to exclusively use European data centres. This means that your data will end up in the US. Once it's in the US, the data is processed according to the US Privacy Act. A legal framework that's far less robust than the GDPR. US law also allows intelligence agencies to collect and use the personal data from US electronic communications services like Google. This also applies to the collected data of European citizens, which is not in line with the GDPR.

In the past, the EU tried to reach an agreement with the US when it comes to the personal data of European citizens being processed in the US. This culminated in the "Privacy Shield" (former Safe Harbor Privacy Principles). The Privacy Shield was supposed to enforce proper 'etiquette' when it came to transferring data to the US. It would safeguard the data of European citizens.

Except it wasn't thorough enough. After a case initiated and won by privacy activist Max Schremms, it was dismissed in July 2020. As a result, US service providers had to find other means to protect the data of EU citizens like: IP anonymisation, offering EU-based hosting…

Despite the Schremms ruling from 2020 , everything carried on as it always had. Or at least, that's what it seemed like. Privacy activist group 'noyb' (None of Your Business) had already filed multiple complaints against the use of Google Analytics and similar tools by several EU-based companies (101 to be exact). In the meantime, one was already dealt with by an Austrian court. A summary of their conclusion on page 38 & 39: "Google cannot guarantee our data's safety from the US intelligence agencies."

As a result, other European countries have begun to reevaluate their stance on the use of Google Analytics. The Netherlands, for example, have since changed their 'privacy-friendly tracking guidelines'. Their guide now opens with a large disclaimer, saying "Google Analytics might not be allowed anymore soon". It looks like it's just a matter of time before they come out and announce a ban as well.

We still don't know how this story will end. As said this ruling is just the first in the 101 series, meaning that it'll take 100 more rulings before we can see the full picture. For now, there are still plenty of ways this can pan out.

What are your options?

1. This could be an edge case

An often omitted detail, this specific complaint featured a Google Analytics implementation where IP anonymisation was not properly configured. There's a small chance that Google Analytics is perfectly okay as long as this feature is enabled.

2. The US could change or scrap FISA

FISA is what allows US intelligence agencies to collect and process the data tech companies like Google have. Once the US can no longer freely spy on non-US citizens, Google Analytics will be in the clear again. However, it's highly unlikely that this will happen.

3. Google simply stops transferring data to the US

It could be as simple as an extra checkbox in a property. If they can guarantee that our data remains in their European data centres, they're in the clear.

4. Google Analytics does end up becoming illegal

Even though it seems unlikely, it might still happen. If that happened most websites would have to move away from Google Analytics and to one of their (EU-based) competitors.

There's no immediate need for most businesses to migrate to Google Analytics alternatives overnight. There will be some big changes in the industry, that's for certain. Make sure you don't rush to another tool, just to make the same mistake all over again. If you migrate to another platform, make sure it doesn't have the same legal issues as Google Analytics. Look for something that's self- of EU-hosted & supports full anonymisation.

See this event as an opportunity to reevaluate your current tracking setup and in general map the tools that might be exporting your data. For. eg. Do we really need all of these tools? Do we really need to track all the data that we do? These are the important questions you need to be asking yourself right now.

Start from the beginning, redefine your KPIs and adjust your tech stack accordingly. It might even be a good time to start moving towards a completely cookieless solution. At the rate at which browsers are discontinuing third-party cookies, this might even be the more urgent matter. Who knows, GA might not even be a part of your cookieless tracking setup.

With contributions from Laura Debruyne, Martijn Lijten & Dumky de Wilde.