Google just got terrible news in Europe - and it could get much worse
Google was just hit by some very bad news coming from Europe, but the news may be even worse for website owners than for Google itself. In an unprecedented case, the court in Austria has just ruled that Google Analytics is in violation with the European data protection laws. As a result, Google Analytics has been made illegal in Austria.
It all comes back to the General Data Protection Regulation (GDPR) observed in Europe. Implemented in 2018, GDPR was created to give European citizens more control over their personal data, both online and offline. Unfortunately, the GDPR and US surveillance laws just do not mix.
According to a decision made in 2020 by the Court of Justice of the European Union (CJEU,) policies that force website providers in the US to provide personal user data to authorities are against the GDPR. While this may not seem that related to Google Analytics at the first glance, it very much is. Some of the information readily collected by US providers is in direct violation with the GDPR, which in theory means that these websites would have to stop collecting private information in order to legally operate within Europe. In practice, it seems that not much has changed since 2018.
Google Analytics is now completely illegal in Austria
Prior to 2020, a law called the Privacy Shield was in place that allowed European data to be transferred to the United States. However, the shield was invalidated by the CJEU on July 16, 2020. Since then, US-based websites were not allowed to transfer the data of European citizens to the US. Of course, this only applies to data that falls under the GDPR, which only includes identifiable information about any given person. However, according to FieldFisher, this also includes IP addresses, as that is regarded as an "online identifier."
Regardless of the 2020 ruling made by the CJEU, many providers continued to send personal data to the US — including Google Analytics. As stated by Max Schrems, honorary chair of NOYB, an European non-profit focused on digital rights, "Instead of actually adapting services to be GDPR compliant, US companies have tried to simply add some text to their privacy policies and ignore the Court of Justice. Many EU companies have followed the lead instead of switching to legal options."
The Austrian Data Protection Authority has now followed up on what the CJEU ruled back in 2020 and made the use of Google Analytics completely illegal. The ruling comes into effect immediately, so all the websites that service Austrian citizens need to act quickly in order to not be fined for violating the local laws.
What will the new court ruling change?
Many companies that operate in Europe will now have to decide between continuing to use Google Analytics and swapping to an alternative website traffic tool. Refusing to comply may result in hefty fines. However, it could be that providers will continue to ignore the European laws and risk the fines: After all, not every such business will be caught or reported. If caught, the price could be high: NOYB has described a case where the Irish Data Protection Commission issued a fine of 225 million euro on WhatsApp for violating data protection laws.
Ultimately, US-based companies will have to think of workarounds for European privacy laws. Simply hosting customer data in Europe would be helpful, although this would of course limit the type of data that can be freely collected and distributed. For the time being, websites that continue to use Google Analytics will need to obtain consent from each visitor prior to collecting any data.
The choice to ban Google Analytics in Austria may be the first step in a larger revolution. Other countries in the European Union are likely to follow, so while Austria may be the first bit of bad news for Google, there is likely much more to come.