Denmark's data protection authority (Datatilsynet) has ruled that the use of Google Analytics violates the GDPR, adding Denmark to the growing list of EU countries that have taken enforcement action against the popular analytics platform.

The Ruling

The Danish authority determined that Google Analytics transfers personal data to the United States without adequate safeguards, in violation of the GDPR's requirements for international data transfers. This follows the Schrems II ruling, which invalidated the EU-US Privacy Shield and raised the compliance bar for any transfer of European personal data to US-based services.

Part of a European Pattern

Denmark joins Austria, France, Italy, Hungary, Finland, Norway, and Sweden in ruling against Google Analytics. These decisions stem from complaints filed by privacy advocacy organization noyb, which systematically challenged the use of US-based analytics tools across EU member states.

While each national authority has ruled independently, the consistent outcomes reflect a shared legal interpretation: standard contractual clauses and other safeguards proposed by Google are insufficient to protect European data from potential US government surveillance.

Implications for Organizations

Businesses operating in Denmark that continue using Google Analytics face potential regulatory action. The ruling effectively requires organizations to switch to analytics solutions that either do not collect personal data or store data exclusively within the EU/EEA. Privacy-respecting, European-hosted analytics alternatives eliminate the data transfer problem entirely.