The Cnil has given formal notice to the manager of a website in France using Google Analytics to urge him to no longer use the very popular audience measurement tool deemed illegal by the authority.
A dashboard on Google Analytics // Source: Myriam Jessier on Unsplash
“ Illegal “. The word is strong and far from trivial. The National Commission for Computing and Liberties (Cnil) is giving notice to a French website to force it to stop using Google Analytics. You have probably already come across the name of this tool widely used by many publishers to measure and analyze the attendance rate.
The authority writes in a press release that it considers, with regard to the GDPR, “that these transfers are illegal and requires a manager of the French website to comply with the GDPR and, if necessary, to no longer use this tool under current conditions “.
Google Analytics data sent to the United States
But what exactly are we talking about here? The Cnil refers here to the data collected by Google Analytics. However, this information is transmitted to servers in the United States of the Mountain View giant. There is therefore a transfer that takes place from France to the country of Uncle Sam and it is precisely this operation that the organization points the finger at.
The Cnil specifies that it has carried out an investigation with other European regulators. The goal : ” analyze the conditions under which the data collected as part of the use of Google Analytics was transferred to the United States and what were the risks incurred for the persons concerned“.
Not GDPR Compliant
However, the CNIL concluded that the transfer of information to the United States was not sufficiently supervised for the moment. At least, not until Washington aligns its privacy policy with European GDPR requirements. In other words, the authority explains that if there are not enough guarantees, there should be no data transfers from France to the United States.
And on the guarantees side, the CNIL was not satisfied.
Indeed, if Google has adopted additional measures to regulate data transfers within the framework of the Google Analytics functionality, these are not sufficient to exclude the possibility of access by American intelligence services to this data.
You will have understood: the Cnil fears that the data aggregated by Google Analytics will be too exposed to the eyes of the American intelligence agencies which could be too interested in your habits on the web. To support its point, the organization recalls that the audience measurement tool assigns each visitor to a website a unique identifier and that this identifier “constitutes personal datawhich should not end up in the United States.
None of Your Business
We do not know who exactly (natural or legal person) was put on notice by the Cnil. However, the authority told theAFP— taken over byBFM— that two other French site managers are also the subject of complaints.
Note also that the Cnil conducted this investigation after being seized by the Austrian association NOYB (None of Your Business) which campaigns for better protection of private data on the Internet.
The site manager given formal notice now has one month to comply. But beyond this publisher, the CNIL’s conclusions could subsequently affect hundreds of thousands (millions?) of platforms, media and services on the web. Google Analytics is really used by a multitude of sites.
On the occasion of Safer Internet Day this Tuesday, we offer you a selection of Google services and applications to use with an Android device to offer your children a secure use of new technologies.
Read more
To follow us, we invite you to download our Android and iOS application. You can read our articles, files, and watch our latest YouTube videos.