Let’s take a look at where things stand in regard to the use of Google Analytics (and data transfer in general) between the United States and Europe.
Legal Proceedings
Early 2022 was awash with news about Austria finding Google Analytics Universal Analytics violates Chapter V (regarding International Data Transfers) of Europe’s General Data Protection Regulation (GDPR) due to the Schrems II decision. As the year continued to roll on, Austria was joined by decisions in France, Italy, and Denmark. Other Data Protection Agencies have not been silent on the matter. Guidance has been issued out of Norway and the Netherlands cautioning against use and recommending looking at alternative vendors.
It’s important to realize that while Google and Google Analytics have been the target of these investigations, they are not the only ones affected. The Schrems II decision has far reaching impacts on any company that transfers data that may be covered by GDPR to the United States.
In response to this, The White House in the United States called for the creation of a Trans-Atlantic Data Privacy Framework to be created, which once agreed upon with the EU, would restore the ability to transfer data to the United States without violation of European law. A draft was sent to the EU for consideration in late 2022.
Since then, the European Commission has issued a draft decision approving the measure and asked the European Data Protection Board for their opinion, which they have recently issued, citing several concerns with the proposed agreement. The formal decision continues to work its way through the EU government with no expected decision date yet issued. However it is unlikely to be resolved before the spring of 2023.
Lastly the United States has FISA Section 702, which is one of the key concerns related to surveillance raised by the Schrems II decision, and it is up for renewal before the end of 2023. Rather than let it expire, which I suspect would help the privacy agreement discussions, the Biden administration has opted to make a case for renewing FISA (Foreign Intelligence Surveillance Act) surveillance powers. I have to wonder if this will ultimately come back to hamper efforts the United States are making in seeking to restore international data transfers.
Google’s Response
Google, for its part, is still rather stuck in the middle of a legal dispute between the United States and the European Union with limited avenues for how they can resolve matters. Two events have started in the past year that move Google into a better (but not ideal) state.
First, they are sun setting Google Analytics Universal Analytics (which is the software mentioned in all of the DPA decisions) in favor of Google Analytics 4, which has more privacy protections built in. However this is a long phase out process with it not being fully complete until July 1st, 2024. While this helps position them long term, this date is still 15 months out at the time of writing, and that’s a long time for other Data Protection Authorities to reach similar decisions as they work through NYOB’s complaints.
Secondly, in the spring of 2022, they did upgrade their Google Analytics 4 product with a number of EU based privacy controls. Those controls likely do not go far enough to address the concerns raised by the Data Protection Authorities as cited by guidance from Denmark and Norway. So while the decisions from the various countries revolved around website operator use of Universal Analytics, the changes made in support of Google Analytics 4 are likely to be found insufficient in altering a decision outcome in the future.
Conclusion
Things do not look positive in my opinion. The agreement between the United States and EU over data privacy will likely continue to run into roadblocks, and even if ultimately successful, I suspect will be immediately challenged in the European Courts. For its part, the United States is likely going to make things harder on themselves by seeking to renew Section 702 powers, which were part of the reason the international data transfer issue exists to begin with.
Google will continue to be stuck in a State level legal dispute which they are being impacted by, but can’t directly address. The various complaints issued by NYOB will continue to be resolved, and Google and Facebook (which were the targets of the complaints) will likely continue to rack up adverse decisions regarding the use of their products.
Finally, Google Analytics 4, while an advancement in many ways, does not go far enough to address the privacy concerns and so I suspect the complaint decisions will find similarly in future cases. This is unfortunate because Google, like other affected businesses, can’t fix the problems raised and so risk losing business from international clients in the meantime.