This Thursday, February 10, a first French website manager was given formal notice because of his use of Google Analytics: web professionals have been warned.
Following numerous complaints from the NOYB association concerning the transfer of data to the United States by Google Analytics, the CNIL has ruled. This is a surprise for website publishers who must comply with the GDPR and, if necessary, no longer use Google’s audience analysis tool.
Problematic data transfer
Practical and free, Google Analytics is used to measure website traffic. This service makes it possible to grant an identifier to each user and to link data concerning him to it.
Problem, the CNIL, in cooperation with its European counterparts, has analyzed the conditions under which the data collected using this tool is transferred to the United States and now considers that these transfers are illegal. In question, the possibility for the American intelligence services to access this data.
Indeed, the use of Google Analytics would conflict with the “Schrems II” decree, issued on July 16, 2020 by the Court of Justice of the European Union. The latter had invalidated the Privacy Shield, which was intended to regulate the transfer of European data to the United States.
What are the consequences for web professionals?
After having recently imposed heavy fines on Google, the CNIL considers that its audience analysis software does not comply with articles 44 and following of the GDPR, which concern the prohibition of the transfer of European personal data to countries which do not do not provide sufficient guarantees.
However, the American company is not held responsible. It is the users of Google Analytics who must find an acceptable solution, using a GDPR-compliant tool.
If the site manager put on notice this Thursday has one month to regularize his situation, the others are warned. They can already look for another way to study their audience while waiting for Google to potentially find a solution. The CNIL recommends in particular the use of tools favoring anonymous statistical data.
In addition, other procedures have already been initiated by the French personal data police against other sites using Google Analytics, including three French sites published by Decathlon, Auchan and Sephora.
Source: Moderator Blog
2