The verdicts indicate a pan-European mindset among the supervisory authorities, even if the individual cases were resolved separately by the respective regulatory agencies that received the initial complaints. It is essential that the pan-European laws are applied uniformly throughout the EU/EEA for the benefit of companies that process personal data as well as the individuals whose personal data is concerned. Because the subject matter of the submitted complaints was identical, the cases were handled jointly in a working group under the supervision of the European Data Protection Board. The legal concerns and their resolutions were examined.

The GDPR’s regulations are intended to safeguard European citizens’ privacy. Among other things, this implies that one must be able to access a website without worrying that one’s personal data may fall into the wrong hands. After carefully examining the possibilities in Google Analytics, the conclusion has been drawn by the Norwegian Data Protection Authority that using the service as it is now without taking any further steps is impossible.

Looking more closely at the tool and the precise settings one may use if one wishes to use Google Analytics in light of the decisions made by the European authorities, has been extremely crucial because Google has started to make more options available for controlling what data may be gathered using the tool following the first Austrian court judgement. The conclusion, however, remains that the tool cannot be used legally.

The fact that the instances reflect a pan-European approach among supervisory agencies indicates that, given a real case with identical circumstances, the Data Protection Authority will reach the same conclusion as the European authorities.

Therefore, companies that use Google Analytics must determine if their potential future usage of the service complies with data protection laws. If the opposite is true, the organization must either make its use of the instrument legitimate or, if necessary, stop using it.

Helping individuals understand their rights and advising organizations on how to comply with data protection laws is a crucial duty for the Data Protection Authorities. In particular, after the judgments made by the European authorities, there has been a huge demand for specialized advice about Google Analytics. Therefore, time has been invested in further researching this particular tool.

So, what to do if you use Google Analytics today?

It’s pretty apparent that many organizations already use Google Analytics, and there used to be a simple way to send data to the USA in the form of a so-called “adequacy decision” from the EU Commission. But in July 2020, the European Court of Justice invalidated this commission decision.

As a result, if one uses Google Analytics, one must develop a strategy to make sure that it is legal by taking additional steps.

Pseudonymization is a potential technological measure that can be pertinent while utilizing Google Analytics. The French data supervisory body has issued extensive instructions for businesses that want to implement effective pseudonymization via a so-called reverse proxy.

If effective precautionary measures are not available, one must discontinue using the tool and maybe find another solution that can give online statistics while also allowing one to comply with data protection requirements, such as not transmitting information about visitors to unsafe or risky third nations.