Use of Google Analytics and data transfers to the United States: the CNIL orders a website manager/operator to comply

Google Analytics provides statistics on website traffic. After receiving complaints from the NOYB association, the CNIL, in cooperation with its European counterparts, analysed the conditions under which the data collected through this service is transferred to the United States. The CNIL considers that these transfers are illegal and orders a French website manager to comply with the GDPR and, if necessary, to stop using this service under the current conditions.

Google Analytics is a service that can be integrated by websites such as online sale sites in order to measure the number of visits by Internet users. In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States.

The CNIL received several complaints from the NOYB association concerning the transfer to the United States of data collected during visits to websites using Google Analytics. In total, 101 complaints were filed by NOYB in the 27 EU Member States and the three other European Economic Area (EEA) states against 101 data controllers allegedly transferring personal data to the US.

An analysis at European level

The CNIL, in cooperation with its European counterparts, analysed the conditions under which data collected through the use of Google Analytics was transferred to the United States and the risks incurred for the individuals concerned. The aim is to collectively draw the consequences of the “Schrems II” judgment of the Court of Justice of the European Union of 16 July 2020, which invalidated the Privacy Shield. The CJEU had highlighted the risk that American intelligence services would access personal data transferred to the United States if the transfers were not properly regulated.