Use Google Analytics as an EU freelancer? Then it’s now time you switch

A ruling concerning Google Analytics should not be overlooked by the EU’s digital, marketing, and social media freelancers, as despite it currently applying only in Austria, the ruling indicates that such creatives who are tasked with measuring web traffic should actively explore alternative software to use, writes Alix Balsan of Gerrish Legal.

A violation

This is all because the Austrian Data Protection Authority (the Datenschutzbehörde, ‘DSB’) this month decided on what is informally being called ‘the Google Analytics case,’ which was brought by non-profit organisation None of Your Business (NOYB).

Rather starkly, the DSB’s judgment concludes that, “the continuous use of Google Analytics by EU entities violates the General Data Protection Regulations 2018 (GDPR), following the Schrems II judgment of 2020.

Recap of the Schrems II judgment:

So let’s have a refresher on Schrems II, since the DSB saw fit to strongly refer to it.

The Court of Justice of the European Union (CJEU) decided in 2020 that EU data transfers to the US violate the GDPR, due to US surveillance laws which require American providers --such as Google -- to provide personal details to the US authorities.  

This practice offers the data of EU residents significantly less protection than the data remaining in the EU, placing EU residents’ privacy at risk and therefore, violating the data protection legislation in the EU.

Examples of US providers includes those used by Americna firm Stripe (which has also recently been sanctioned for GDPR breaches), and of course, the Respondent of the moment, Google Analytics.

One in the eye of SCCs

At the time, it was thought that Standard Contractual Clauses (SCCs) could be included as further protection for the transfers being sent from the EU to the US. But in its ruling this month, the DSB remarked:

"With regard to the contractual and organizational measures outlined, it is not apparent, to what extent [the measures] are effective in the sense of the above considerations.”

For those who want the quote in its complete context, see p37 paragraph f of the ruling.

The bottom line?

Austrian lawyer, Max Schrems, founder of NOYB and for whom Schrems I and II is named after, has summed up the ruling, in the following, no-nonsense manner:

“The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.”

Worryingly for some, this decision is expected to be repeated and therefore gain traction throughout EU states, because it was the result of a collaboration between EU regulators.

Dual significance

Indeed, at the time of writing, data protection authorities are condemning those flaunting the Schrems decision, which is significant for the many EU companies continuing to send personal data of EU users to the US. It’s also significant, of course, for the American companies providing these services!

And let’s not underestimate the scale here. According to Stackshare, some 68,489 companies worldwide such as Uber, Airbnb, and Google themselves all reported using Google Analytics and so partake in sharing personal data of EU residents to the US. Overall, Google Analytics is the most commonly used statistical program within the EU, meaning that most EU companies still forward users’ data to the US -- in spite of ‘Schrems II’ and will now finally need to find alternatives due to the DBS’s judgement. Only those companies in the EU will be affected by the January ruling, however.

The surge, Schrems III, and shopping around

Positively if your work for your own website or your client’s website involves ‘GA’ -- as many abbreviate it to,  there are a number of analytical tools that can be used to the same end as the software, such as Fathom Analytics and Plausible. Both of these have enjoyed a surge in reviews since the original Schrems rulings, and likely will now experience another such surge in the wake of what is already being called “Schrems III”!

But neither of the above tools is free (as was Google Analytics), with Fathom Analytics starting at $140 (£105) annually, and Plausible starting at $100 annually. However, many reviews demonstrate these alternatives as more efficient and easier to use than the now-banned Google Analytics.

As to the future, who knows what’s next!  It is not impossible for the US to adapt its legislation such that an Adequacy Decision could be granted by the EU, thereby rendering the current conversation moot.

In the meantime, however, we believe that the best option is to shop around and explore alternative web analytics services for your websites – which don’t violate the GDPR!

The future (includes a few unknowns)

To reiterate, the DBS ruling applies only in Austria, but it is relevant throughout the EU as other EU Member States are expected to repeat what was a collaborative effort of the EU Data Protection Board (EDPB).

Online, many people are therefore now asking about the speed of EU firms’ conversion away from Google Analytics to its alternatives but, right now, it’s hard to gauge. Remember, the DBS has issued what is, in effect, an interpretation-cum-enforcement of a case from 2020, and it’s only now just seeing the light! Furthermore, the speed of users transferring from Google Analytics to alternatives will likely vary from member state to member state. As for the UK, our nation has its own GDPR and so we are not bound by EU happenings. Given that the UK is in the early stages of a data protection reform, it is unclear whether the UK will react to this judgment.