Google Analytics and GDPR: what the regulators decided, and what to do now

Google Analytics and GDPR have a history. In 2022 three European regulators looked at the same tool and reached the same view: with visitor data going to the United States under the arrangements of the time, a website couldn’t use it as it stood. In 2023 the European Commission adopted a new decision on transfers to the US, and the picture changed.

Search for “google analytics gdpr” and you’ll find vendor pages that stop at “not compliant by default” and never say what was decided. This post goes to the decisions. What the Austrian, French and Italian authorities found, what the EU-US Data Privacy Framework did in July 2023, which part of the question it left alone, and what a small site should do now.

Is Google Analytics GDPR compliant? Two separate questions

The question bundles two things that have little to do with each other.

The first is consent. Analytics sets a cookie on the visitor’s device and reads an identifier from it. In the EU and UK that needs a yes first, and the EDPB’s guidelines on consent say so plainly: consent should be given prior to the processing activity.

The second is transfers. Once the data is collected, where does it go, and under what arrangement? That’s Chapter V of the GDPR, a separate test.

The CNIL makes the split explicit: some audience measurement tools are exempt from consent in France, and it says the exemption est sans incidence sur les questions relatives aux transferts des données, which is to say it has no bearing on the transfer question. A tool can pass one test and fail the other.

The 2022 decisions were all about the second question.

What the regulators decided in 2022

On 16 July 2020 the Court of Justice of the EU struck down the Privacy Shield, the arrangement that had covered transfers to the US, in the judgment known as Schrems II. Within weeks the campaign group noyb filed 101 complaints across the EEA against websites sending data to Google and Facebook.

Austria: the first of the 101

The Austrian authority, the DSB, decided the first of them in a partial decision numbered D155.027, made public in January 2022. The complaint, filed on 18 August 2020, concerned a visit to an Austrian website four days earlier. The DSB found that by implementing Google Analytics the site had sent the complainant’s personal data to Google LLC: at least unique user identification numbers, the IP address and browser parameters. The standard contractual clauses the site had signed with Google did not provide an adequate level of protection, because Google falls under US surveillance law and the extra measures Google had added were nicht effektiv, not effective, since they didn’t remove the possibility of access by US intelligence services.

The conclusion is one line of German. The tool, at least in the version of 14 August 2020, could nicht in Einklang mit den Vorgaben von Kapitel V DSGVO genutzt werden: not be used in line with Chapter V. The complaint against Google itself was dismissed, because the DSB held that the transfer rules bind the party sending the data, not the one receiving it.

France: a one-month order

The CNIL took the lead on a complaint about a French online shop. The redacted decision, published through the EDPB, found that the visitor identifier in the Analytics cookie, the IP address and browser data constitute personal data, and that Google’s extra measures are not effective insofar as none of them addresses the specific issues in the present case. The order gave the company one month to bring the processing into line, notably by ceasing processing activities which relate to the current version of the tool Google Analytics.

The CNIL’s review of 2022 counts more notices over Google Analytics that year. Its guidance also closed the obvious shortcut: une simple modification du paramétrage de l’outil est insuffisante. Changing the tool’s settings alone wasn’t enough. What it offered instead was a proxy server between the visitor and the tool, with a list of conditions, and it called that setup costly and complex.

Italy: a warning and ninety days

The Garante’s decision of 9 June 2022 concerned Caffeina Media, which ran a news site with the free version of Analytics. The decision holds that an IP address is personal data, and that Google’s “IP anonymisation” setting consiste di fatto in una pseudonimizzazione, amounts in practice to pseudonymisation, because Google can match a truncated address with other data it holds. The extra measures non possono ritenersi adeguate, could not be considered adequate. The Garante also found the site’s privacy notice didn’t clearly describe the transfers, which it treated as a separate shortfall under the transparency articles.

The outcome was a warning and ninety days to put adequate extra measures in place, failing which data flows to Google LLC would be suspended. The press release of 23 June asked every Italian website operator to check its own analytics tools.

What the Data Privacy Framework changed in 2023

On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. The Commission’s page says personal data can flow freely from the EU to companies in the United States that participate in the Data Privacy Framework. The EDPB’s information note spells out the mechanics. Transfers to organisations on the Data Privacy Framework List, kept by the US Department of Commerce, may rest on the adequacy decision without the need to rely on Article 46 GDPR transfer tools. Transfers to US companies not on the list still need those tools, such as standard contractual clauses.

That removes the ground the 2022 decisions stood on: no transfer tool then available worked for data going to Google LLC, and now there is one. The CNIL’s audience measurement guidance now says transfers to US organisations on the framework can be made freely, and keeps the proxy for tools that still send data to US organisations that aren’t on it. Its questions and answers on the adequacy decision add two practical points. Before transferring, a company should s’assurer que l’organisme destinataire figure sur cette liste, make sure the recipient is on the list, and read the entry, since it may not cover every subsidiary or every category of data. And past shortfalls tied to Schrems II ne pourront néanmoins pas faire l’objet de mise en demeures ou d’injonctions pour l’avenir: no formal notices or orders over them for the future.

The decision was challenged in court and survived: in Latombe v Commission, the General Court dismissed the action on 3 September 2025.

The UK has its own route to the same list. The UK-US data bridge, formally the UK Extension to the EU-US Data Privacy Framework, took effect on 12 October 2023, and the government’s explainer notes that it will not remove the obligations of UK companies under UK data protection law.

For Analytics, the entity matters. Google’s help page says that Google operates as a data processor for Google Analytics and points to its data processing terms, which name the Google company you contract with. On the list, the transfer rests on the adequacy decision. Off it, you’re back to standard contractual clauses, or to the CNIL’s proxy.

Google Analytics cookie consent: the part the framework didn’t touch

The 2023 decision is about where data goes. Whether the tag may run at all is unchanged.

In the UK, the ICO’s exception for statistical purposes does not allow you to monitor or track individual visitors to your service, and does not apply to purposes related to online advertising. Analytics assigns each visitor an identifier and follows them from page to page, which is what the exception rules out.

Google’s own position matches. Its EU user consent policy asks sites with visitors in the EEA, the UK and Switzerland to obtain consent for cookies or local storage where legally required, and to retain records of it. The same help page that describes Google as a processor says Analytics does not log or store IP addresses and offers retention settings. Those govern what Google keeps, not whether the tag waits. For how a tag can be made to wait, see Google consent mode v2.

What a small site should do now

Three things:

• Consent first: Analytics waits for a yes. Nothing from google-analytics.com or googletagmanager.com before the banner is answered, Reject on the first screen, and the tag stops when a visitor changes their mind.
• Name it in the policy: Google Analytics by name, the Google entity in your terms, what the data is for, how long you keep it, and that it goes to the United States and on what basis. The Garante treated a vague notice as its own shortfall.
• Transfers: look up that Google entity on the Data Privacy Framework list, read its entry, and keep a dated screenshot. If it isn’t there, you need standard contractual clauses and a transfer assessment, or a setup that keeps the data in Europe.

Check your own site in five minutes

Use your phone, no tool needed:

1. Open a private window, load your homepage and leave the banner alone. Tap the padlock or site information icon, then the cookies or site data entry. If google-analytics.com, googletagmanager.com or google.com already holds data, the tag ran before a choice was made.
2. Tap Reject and reload. Check the same list. It shouldn’t have grown.
3. Open your privacy notice and search for “Analytics”. Is Google named? Does it say the data goes to the US, and on what basis?
4. Find the Google entity named in your Analytics terms, search for that name on the Data Privacy Framework list and read the entry.
5. Find the way to withdraw consent after saying yes. It should take as little effort as saying yes did.
6. Write down today’s date next to what you found.

The wider list of what the GDPR asks of a small site is in the GDPR compliance checklist, and the cookie names you’ll meet in step 1 are explained in types of website cookies.

Peeky reads the public pages of your site. For Google Analytics, the checks are EU-01 for a tag that fires before the banner is answered, EU-04 for a service your privacy notice doesn’t name, and EU-06 for data sent outside Europe without a stated basis, all in the Handbook.

Questions people ask

Is Google Analytics compliant with GDPR?

It's two questions, not one. Consent for the cookies is on you, and the EDPB says consent should be given prior to the processing activity. Transfers to the US changed on 10 July 2023, when the Commission adopted an adequacy decision for organisations on the Data Privacy Framework list. Which Google entity you contract with, and whether it's on the list, is the part to check.

What did the EU regulators decide about Google Analytics in 2022?

Three authorities looked at the tool and reached the same view. The Austrian DSB found a website's use of it couldn't be squared with Chapter V of the GDPR. The CNIL gave a French shop one month to stop using the then-current version. The Italian Garante issued a warning and ninety days to fix the transfers.

What is the Data Privacy Framework?

A European Commission decision of 10 July 2023 that lets personal data flow freely from the EU to US companies that take part in it. The EDPB's note says transfers to organisations on the list no longer need standard contractual clauses, while transfers to US companies not on the list still do. The General Court upheld the decision on 3 September 2025.

Does Google Analytics need cookie consent?

In the UK and EU, usually yes. The ICO's exception for statistical purposes does not allow you to monitor or track individual visitors, and Analytics gives each visitor an identifier. The 2023 transfer decision didn't touch this part.

What should my privacy policy say about Google Analytics?

Name it, name the Google entity you contract with, say what the data is for and how long you keep it, and say that data goes to the United States and on what basis. The Italian Garante's 2022 decision found a notice that didn't clearly describe the transfers fell short on its own, separately from the transfer itself.