Screenshot from isgoogleanalyticsillegal.com
The French National Commission for Informatics and Liberties (Commission Nationale de l'Informatique et des Libertés, CNIL) considered the complaints received against the American service Google Analytics. The study of the traffic showed that Google Analytics collects personal data of French citizens and sends them to US servers in violation of European GDPR laws.
On February 10, 2022, the CNIL commission banned the use of this web analytics system in its current form. The official decision is binding on the operators of all websites in France. You have a month to complete the requirements.
France became the third EU country after Austria and the Netherlands to make such a decision. Everything goes to the fact that Google Analytics will be banned throughout the EU.
Excerpts from the CNIL decision (regulator's reasoning):
Google Analytics is a service that can be integrated into websites to measure the number of visits. Each visitor is assigned a unique ID. This identifier (which is personal data) and associated data are transferred by Google to the United States.
CNIL has received several complaints from the association NOYB [European Center for Digital Rights; it was founded by the Austrian lawyer Max Schrems, known to readers and since his student days - approx. per.] regarding the transfer to the United States of data collected using Google Analytics. In total, NOYB filed 101 complaints in 27 EU member states and three other European Economic Area states against 101 data operators allegedly transferring data to the US.
The CNIL Commission, in collaboration with European counterparts, analyzed the conditions under which Google Analytics data is transferred to the United States and the associated risks in order to clarify the implications of the European Court of Justice judgment of 16 July 2020 (Schrems II). The court indicated that US intelligence services could get access to the data.
CNIL concluded that, following the decision of the European Court of Justice, the transfer of personal data is not sufficiently regulated. Although Google has taken additional measures in the context of Google Analytics functionality, they are not sufficient to prevent the data from being available to US intelligence agencies. This creates risks for users of French sites.
Therefore, user data is transferred to the USA in violation of Article 44 et seq. of the GDPR.
The CNIL has instructed site owners to bring this process into line with the GDPR by ending the use of the Google Analytics feature if necessary (under current terms). Operators have a month to comply with the requirements.
With regard to web analytics, CNIL recommends the use of exclusively anonymous statistics, the collection of which does not require the consent of the user, if the operator guarantees that there is no illegal transmission of data.
The CNIL decision also applies to other tools that transfer data from European users to the US. Corrective measures for them may be taken in the near future.
From the text of the official decision, we can conclude that the CNIL recognized the numerical user identifier (Client ID) as personal data:
As you know, the Google Analytics backend is partially located in the US, so some data is sent there automatically. Apparently, it is not easy to create many standalone isolated backends for each jurisdiction.
On this topic:
GDPR. Section V
The decision of the European Court of Justice in Luxembourg of 16 July 2020 invalidates the EU-U.S. Privacy Shield on the transfer of personal data between the US and the EU (also known as the Schrems II decision)
bbabo.Net