In a landmark decision, the Austrian Data Protection Authority (DSB) declared that transferring data from the EU to the United States through Google Analytics violates European privacy law. Given that millions of websites worldwide depend on Google Analytics, the ruling sent shockwaves through the industry.

How We Got Here

The ruling traces back to the "Schrems II" decision of 2020, which invalidated the EU-US Privacy Shield framework for data transfers. Following that decision, the advocacy organization noyb filed 101 model complaints against websites that continued sending user data to the US via Google Analytics. Rather than making structural changes to comply with GDPR, many US technology companies attempted to address the issue through updated privacy policy language alone.

Who Is noyb?

noyb (none of your business) is an Austrian non-profit organization dedicated to enforcing internet privacy rights. The group has filed hundreds of formal GDPR complaints, including 422 related to non-compliant cookie banners. Its founder, Max Schrems, is a lawyer and privacy advocate whose legal challenges have reshaped the transatlantic data transfer landscape.

What This Means for Website Operators

The practical takeaway is clear: relying on Google Analytics creates real legal exposure. Under GDPR, penalties can reach 20 million euros or 4% of an organization's global annual turnover, whichever is higher. Website owners should evaluate privacy-focused analytics alternatives that store data within Europe and do not transfer personal information to US servers.

Subsequent Rulings Across Europe

January 2022: The Dutch privacy authority issued a warning that Google Analytics could be declared illegal in the Netherlands
February 2022: France's data protection authority (CNIL) reached the same conclusion as Austria
September 2022: Denmark's data protection agency ruled Google Analytics incompatible with European data protection regulations