On March 16, 2022, Google announced the launch of Google Analytics 4. Google is attempting to end data protection discussions that have arisen in the EU about cookies and international data transfers to the US.
The data protection organization noyb submitted over 100 complaints to 30 data protection authorities in Europe. The complaints focused on the permissibility of Analytics to transfer personal data (cookies) from EU citizens to Google servers in the US. The General Data Protection Regulation (“GDPR”) following the Schrems II ruling of the Court of Justice of the European Union.
Subsequently, the French and Austrian data protection authorities ruled that the transfer of personal data from the EU to the US using the Google Analytics cookie is illegal.
What is new about Google Analytics 4?
The most significant change is that Google Analytics 4 no longer stores IP addresses compared to previous versions. This will limit data transfers, which was complaint before the Schrems II ruling.
Google’s former analytics solution Universal Analytics will no longer be available from July 2023. Users should implement Google Analytics 4 by then.
However, very up to date: the discussions continue!
This week, the data protection organization noyb published that the Austrian data protection authority issued a second decision – clearly going beyond the first one:
According to this, Google’s IP anonymisation is declared a useless protective measure for data transfers between the EU and the United States:
- Firstly, Google’s IP anonymisation only concerns the IP address as such. Data such as online identifiers set by cookies or device data are transmitted unencrypted.
- Secondly, IP anonymisation only takes place after the data has been transmitted to Google.
So it remains exciting, especially since other data protection authorities, such as the Spanish and Luxembourg data protection authorities, have closed the complaint procedures – without commenting the illegal use of Google Analytics. Reason: the respective websites have stopped using Analytics.