Are the days of Google Analytics numbered?

13 January 2022

2020 and 2021 have been chaotic, to say the least. For digital marketers, 2022 is already off to a similar start. An Austrian judge ruled that the use of Google Analytics violates the GDPR. Considering that the tool has a market share of 85.2%, this has caused a lot of panic in the industry. However, before we start making rash decisions, it's time to look at the facts. Put all of those ideas of throwing your entire analytics stack out the window aside, sit down and read this.

Google logo on roof

Where the problem begins

The GDPR is applicable to personal data. But what does the EU regard as personal data? The fact that you can't process names, addresses or phone numbers without legal grounds is, by now, accepted as common sense. However, there's one piece of commonly processed data that's often forgotten: the IP address. An IP address can be used to trace a person's geographical location. As such, the GDPR classifies it as personal data.

The entire internet is built around IP addresses. A web server has to receive your IP address to serve you the content you want to see. Luckily you can do this under "legitimate interest", which means you don't need the user's explicit consent. Requests that send data to Google's servers are not as fortunate. Even though you can enable IP anonymisation in Universal Analytics, and GA4 anonymises it by default. However, when you send the data to Google's server, your IP address will still be part of the request itself. And that's where things get tricky.

Data transfers between the EU and the US

You see, at the time of writing, Google Analytics doesn't give you the option to exclusively use European data centres. This means that your data will end up in the US. Once it's in the US, the data is processed according to the US Privacy Act. A legal framework that's far less robust than the GDPR. US law also allows intelligence agencies to collect and use the personal data from US electronic communications services like Google. This also applies to the collected data of European citizens, which is not in line with the GDPR.

In the past, the EU tried to reach an agreement with the US when it comes to the personal data of European citizens being processed in the US. This culminated in the "Privacy Shield" (former Safe Harbor Privacy Principles). The Privacy Shield was supposed to enforce proper 'etiquette' when it came to transferring data to the US. It would safeguard the data of European citizens.

Except it wasn't thorough enough. After a case initiated and won by privacy activist Max Schremms, it was dismissed in July 2020. As a result, US service providers had to find other means to protect the data of EU citizens like: IP anonymisation, offering EU-based hosting…

The Austrian ruling that changed it all

Despite the Schremms ruling from 2020 , everything carried on as it always had. Or at least, that's what it seemed like. Privacy activist group 'noyb' (None of Your Business) had already filed multiple complaints against the use of Google Analytics and similar tools by several EU-based companies (101 to be exact). In the meantime, one was already dealt with by an Austrian court. A summary of their conclusion on page 38 & 39: "Google cannot guarantee our data's safety from the US intelligence agencies."

As a result, other European countries have begun to reevaluate their stance on the use of Google Analytics. The Netherlands, for example, have since changed their 'privacy-friendly tracking guidelines'. Their guide now opens with a large disclaimer, saying "Google Analytics might not be allowed anymore soon". It looks like it's just a matter of time before they come out and announce a ban as well.

Related articles

Is it set in stone?

We still don't know how this story will end. As said this ruling is just the first in the 101 series, meaning that it'll take 100 more rulings before we can see the full picture. For now, there are still plenty of ways this can pan out.

What are your options?

1. This could be an edge case

An often omitted detail, this specific complaint featured a Google Analytics implementation where IP anonymisation was not properly configured. There's a small chance that Google Analytics is perfectly okay as long as this feature is enabled.

2. The US could change or scrap FISA

FISA is what allows US intelligence agencies to collect and process the data tech companies like Google have. Once the US can no longer freely spy on non-US citizens, Google Analytics will be in the clear again. However, it's highly unlikely that this will happen.

3. Google simply stops transferring data to the US

It could be as simple as an extra checkbox in a property. If they can guarantee that our data remains in their European data centres, they're in the clear.

4. Google Analytics does end up becoming illegal

Even though it seems unlikely, it might still happen. If that happened most websites would have to move away from Google Analytics and to one of their (EU-based) competitors.

Is it growth you’re after?

From auditing to market research, brand & communication strategies and intelligent UX design, your brand’s path upwards can kick off today. High time we sparked interaction with your audience – together?

Laptop shopping data overview

We have to keep moving forward

There's no immediate need for most businesses to migrate to Google Analytics alternatives overnight. There will be some big changes in the industry, that's for certain. Make sure you don't rush to another tool, just to make the same mistake all over again. If you migrate to another platform, make sure it doesn't have the same legal issues as Google Analytics. Look for something that's self- of EU-hosted & supports full anonymisation.

See this event as an opportunity to reevaluate your current tracking setup and in general map the tools that might be exporting your data. For. eg. Do we really need all of these tools? Do we really need to track all the data that we do? These are the important questions you need to be asking yourself right now.

Start from the beginning, redefine your KPIs and adjust your tech stack accordingly. It might even be a good time to start moving towards a completely cookieless solution. At the rate at which browsers are discontinuing third-party cookies, this might even be the more urgent matter. Who knows, GA might not even be a part of your cookieless tracking setup.

With contributions from Laura Debruyne, Martijn Lijten & Dumky de Wilde.

Glenn Weuts | iO
About the author/speaker
Glenn Weuts
Head of Marketing Technology - iO

As Head of Marketing Technology at iO, Glenn Weuts is absolutely in the right place. Convinced of the watertight truth that only data can offer — in combination with his profound knowledge of analytical tools and platforms — measuring and interpreting user data energises him every day. His output? Advice for sound marketing.

Stay informed. Subscribe to our newsletter

iO respects your privacy. You can unsubscribe at any time.

 Or get updates & insights via our WhatsApp newsletter!