2026-08-04

Google Analytics and GDPR: is it illegal in Europe?

You read the headline in 2022. Austria ruled Google Analytics unlawful. Then France. Then Italy.

You run a webshop. You are not a lawyer. You have a tracking code on every page and a supervisory authority that can issue fines.

So you did what most people did. You waited to see what happened next.

Then nothing obvious happened and the question quietly moved to the bottom of your list. It is still there. And it still has a real answer.

Here is the honest version, without the scare headlines and without the vendor blog spin. What actually happened, what changed since and the two questions that decide whether you have a problem.

One note before we start. This is not legal advice. It is a map of the decisions so you can ask your own lawyer a sharper question.

What actually happened, in dates

The story is short and it has four moments.

If you would rather skip the legal history, the short answer is a GA4 alternative.

July 2020. The Court of Justice of the European Union issued the ruling known as Schrems II. It invalidated the Privacy Shield, the framework that had made EU to US data transfers straightforward. The reason was US surveillance law, which the court found incompatible with EU protections.

13 January 2022. The Austrian data protection authority decided a model case brought by the privacy group noyb. Its conclusion: a website transferring personal data to the US through Google Analytics violated the GDPR.

10 February 2022. The French CNIL reached the same conclusion and gave the organisation one month to fix it.

Through 2022. Italy and other member states followed with comparable decisions. The Austrian case was one of 101 complaints noyb filed across Europe so this was a coordinated wave, not a local accident.

"Instead of actually adapting services to be GDPR compliant, US companies have tried to simply add some text to their privacy policies and ignore the Court of Justice."

Max Schrems, honorary chair of noyb, 13 January 2022

That was the state of play for about eighteen months. Then the legal ground moved.

What changed in 2023

10 July 2023. The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework.

In plain terms, an adequacy decision says that a country protects personal data well enough so transfers there do not need extra safeguards. For companies certified under the framework, the specific problem behind the 2022 rulings went away.

That is the part most articles from 2022 never got updated to include.

It is also the part that vendors overstate in both directions. The adequacy decision did not declare Google Analytics compliant. It removed one objection, the transfer objection, for certified recipients.

Two things remain open.

The framework is contested. The previous two arrangements, Safe Harbour and Privacy Shield, were both struck down by the same court. Legal challenges to this one exist. Nobody can promise you it will still stand in three years.

The cookie question was never about transfers. That one is separate and nothing in 2023 touched it.

So is it illegal today?

The useful answer is not yes or no. It is: which of the two obligations are you at risk on?

Obligation one: consent for storing on the device. This comes from the ePrivacy rules, implemented in each member state's national law. If you place a cookie that is not strictly necessary for the service, you need prior consent. Analytics is not strictly necessary.

This applies whatever the transfer situation is. It applied before 2022 and it applies now.

Obligation two: a lawful basis and safeguards for personal data. This is the GDPR. IP addresses and device identifiers are personal data. Transfers to the US are currently covered by the adequacy decision, if the recipient is certified.

Most shops that get into trouble get there on obligation one, not obligation two. The banner is misconfigured, fires the tag before consent or offers no real choice.

Still with me? Good, because the next part is what an inspection actually looks at.

What an authority actually checks

Supervisory authorities are practical. In a complaint driven inspection they look at a short list of concrete things.

• Does the tracker fire before consent? Open your site in a private window and check the Network tab. If a request goes out before you click anything, that is the most common finding.
• Is refusing as easy as accepting? A prominent Accept button next to a buried Settings link is a documented problem across the EU.
• Does your privacy notice match reality? If it lists three tools and the page loads five, the mismatch is visible in thirty seconds.
• Can you show the consent record? You have to be able to demonstrate that consent was given, which means storing it.
• Do you have a processor agreement? For every tool that handles personal data on your behalf.

None of those require a lawyer to check. All of them require someone to actually look.

Three ways to reduce the risk, in order of effect

1. Remove the obligation instead of managing it. If your analytics stores nothing on the device and collects no personal data, both obligations fall away for that tool. There is no consent to collect, no transfer to justify, no record to keep.

2. Keep the data in the EU. If your analytics runs on EU servers under an EU provider, the transfer question does not arise at all, regardless of what happens to the adequacy framework.

3. If you keep Google Analytics, fix the banner first. Block the tag until consent, make refusal one click, log the consent and update your privacy notice. This does not remove the risk, it manages it. It also means you keep losing the visitors who decline.

Notice that the first two remove a category of risk, while the third one only reduces it. That difference matters more than any single ruling.

What this costs you if you do nothing

Fines are the headline but they are rarely the first thing that happens. A complaint usually starts with an information request and a deadline.

The real costs are quieter.

You spend hours on consent tooling. You explain to a client or a partner why their data flows to a US company. You carry an item in your risk register that never resolves. And you make decisions on traffic numbers that are missing everyone who said no.

Where StatJolt fits in

StatJolt was built so that both obligations stop applying.

It sets no cookies and writes nothing to the visitor's device. That removes the ePrivacy consent requirement for the analytics itself.

It collects no personal data and builds no visitor profiles. There is nothing to establish a lawful basis for.

The servers are inside the EU, in Germany and Finland. No transfer question arises and none will arise if the adequacy framework changes again.

For an audit, that turns a long conversation into a short one. There is no consent record to produce for analytics, because there is no consent to collect.

If you only read one box

Several EU authorities did rule Google Analytics unlawful in 2022, on data transfer grounds and the 2023 adequacy decision removed that particular objection for certified recipients. The consent obligation for cookies was never affected by any of it and that is where most shops are actually exposed. If you want the question closed rather than managed, use analytics that stores nothing on the device and runs inside the EU.

Back