The Austrian Data Privacy Authority says: Google Analytics is illegal.


The Austrian data protection activist Max Schrems made another coup by pointing to a landmark decision by the Austrian Data Protection Authority (DPA), which ruled that using Google Analytics violates the GDPR (EU Data Protection Regulation).


What happened?

Schrems went (as already done in 2020) as a private citizen and directly injured party in front of the Austrian Authority, claiming against how an Austrian companyNetdoktor. at uses Google Analytics, that is, same as most European companies do: passing traffic data to Google Analytics.

So what? Well, the GDPR established an “export ban on data” if the destination is an “unsafe country”.

The USA is an unsafe country.

From the personal data point of view, the USA are unsafe, so found already in 2020 the European Court of Justice (ECJ), when declared that the Privacy Shield data transfer agreement was not sufficient to protect people’s data as defined by the GDPR.

The crucial point of criticism by the European judges was the fact that law enforcement agencies in the USA have access to the data. In the recent past, several cases have become public in which the CIA, FBI or NSA have used data from Google Maps, for example, to track suspected criminals.

Minor adjustments made by Google are not enough.

After the ECJ ruling in 2020, Google introduced minor security measures and assured its customers that their data was safe. Still, these measures cannot entirely prevent data from being accessed by US authorities, says the Austrian Authority.

What will happen?

When a private individual sues the digital provider, the judgement is transferable 1:1 to all other website users. That means: we cannot ignore the problem anymore, and operators – website owners, digital service providers, marketers – need to find solutions.

Two solutions.

Solution number one is thoroughly controlling what data websites transfer to the USA: it must be anonymised before transferral, for sure. But even that would not help, according to the Austrian data regulator. Google Analytics collects so many other data points that it is still possible to get back to the user source.

Time to consider analytics alternatives. At best, European.

Time, probably, to rely less on Google Analytics and consider the European alternatives, such as the Polish solution of Piwik, or the German Etracker or Webtrekk. The latter is now part of the American company Mapp, but clients can install the solution on-premise or rely on analytics servers located in Europe.

One way or the other, it is time for Europe to make the GDPR not only a set of legal requirements but an engine for changing business practices and promoting the adoption of privacy-compliant, at best 100% European, analytics solutions.

Have you ever heard about “digital sovereignty”?

go deeper
Media Digest

News and numbers, carefully selected.
Read online the past issues of the Weekly Media Digest newsletter.
Upgrade to premium to get it delivered to your inbox.

🗞️ MEDIA Digest
28 january 2022
  • In this issue: German Publishers criticise the EU proposals for ruling the digital services, and go against Google banning third-party-cookies ● Peacock starts in Germany ● FAZ cooperates with Pantaflix. ● ARD conquers social media.
sez video 2
audio and voice
big picture