The challenge lies in the fact that privacy legislation in the EU and the US differs significantly, and that no clear agreement exists on how data about EU citizens may be used when transferred to US-owned servers. At the time of writing, an agreement between the EU and the US is being worked on under the name Trans-atlantic Data Privacy Framework, which is intended to ensure that all transfers of data about EU citizens take place in accordance with GDPR.
See the full press release from the Danish Data Protection Agency
In the following, we take a closer look at what your business needs to consider until that agreement is in place.
What options does your business have?
The Danish Data Protection Agency has issued recommendations on what businesses can do if they wish to continue using Google Analytics for data collection and analysis. You can do one of two things:
- Ensure the tool is used lawfully by implementing a number of supplementary measures that ensure the data sent to Google's servers in the US is pseudonymised — this is known as a reverse proxy.
- Stop using the tool and find an alternative that has been approved by data protection authorities.
While we wait..
... Let's look at what the two options entail.
Solution 1:
For Google Analytics to be used lawfully in Denmark, it requires GA to be set up with a proxy server. Here, the Danish Data Protection Agency aligns with the French authorities, CNIL, who have produced a guide — “how to make your analytics tool compliant with the GDPR?” — for the lawful configuration of Google Analytics using a proxy server. In short, this configuration must limit the transfer of data.
For the setup to be considered lawful, 7 necessary measures must be implemented:
- The absence of transfer of the IP address to the servers of the analytics tool
- The replacement of the user identifier by the proxy server
- The removal of external information from
- The removal of any parameters contained in the collected URLs
- Reprocessing of information that can be used to generate a fingerprint
- The absence of collection of cross-site or lasting identifiers
- The deletion of any other data that could lead to re-identification
Although the technical measures open a loophole allowing Google Analytics to be used lawfully from a marketing perspective, several of the points will remove the ability to analyse data at channel level and achieve the same depth of performance insight.
Solution 2:
Rather than taking the technical route, it is also possible to find an entirely different alternative to Google Analytics. However, setting up a new analytics tool from scratch can be quite a task. This process requires resources that most businesses simply do not have available.
The vast majority (over 90%) of websites support Google Analytics, but only around 10% support an approved alternative such as Piwik Pro, which means that external assistance will most likely be needed to set it up. In addition, most dashboards are built on Google Analytics data, and a new solution will also be required here in the event of a switch.
Where does this leave you as a business?
The Danish Data Protection Agency has not set a firm deadline for when businesses must have a new solution in place that complies with GDPR legislation.
The message from the Danish Data Protection Agency is that if you use Google Analytics, you must lay out a plan to make your use lawful by implementing supplementary measures.”
In the meantime, the priority should be to look at a solution that ensures the most important historical data is preserved, and to draw up a plan for what a future tracking setup might look like.
Update 12.10.2022
On Friday 7 October, Joe Biden signed an executive order, which is the first step in a new Privacy Shield 2.0 agreement that could be in place within 6 months.
This could mean that you will be able to lawfully transfer personal data to the US through tools such as Google Analytics from spring 2023.
However, it has been seen before that these processes can drag on — and it is already being predicted that Max Schrems and the 'None of Your Business' organisation are gearing up to put a stop to the potential agreement.
Update 11.07.2023
Google Analytics 4 (GA4) was declared lawful in Europe on 11 July 2023, following the adoption of the new EU-US Data Privacy Framework. The agreement provides clarity and legal certainty for businesses transferring data between the EU and the US, and includes strict safeguards limiting access by US intelligence services to EU data. These measures include the establishment of a Data Protection Review Court, which EU citizens can approach in the event of complaints.
Businesses using GA4 are still responsible for ensuring compliance with all relevant data protection rules, including GDPR, cookie legislation and more. However, American software is no longer an obstacle to achieving compliance.
