Google Analytics is a widely deployed, free-to-use web and app measurement platform operated by Google LLC, a wholly owned subsidiary of the publicly traded Alphabet Inc.; its own terms and privacy documentation disclose that it collects device, browser, cookie, and event-level data and can link that data to other Google advertising and cross-site/app activity for customers who enable features like Google Signals. Google's Analytics Terms of Service state that Google will not share customer data with third parties except with consent, for legal compliance, or through service providers bound by confidentiality obligations, though Google's broader privacy policy discloses extensive linking of analytics data with advertising activity across a large partner network. Since 2022, multiple EU data protection authorities (Austria, France, Italy, Sweden, and others) found that transfers of Google Analytics data to the United States violated GDPR data-transfer rules, with Sweden's IMY issuing fines in 2023, though the July 2023 EU-U.S. Data Privacy Framework adequacy decision has since provided a mechanism intended to address that specific transfer issue.
TRACK RECORD
3 ENFORCEMENT ACTIONS
[2023-07-10]
On July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework, concluding that the United States ensures a level of data protection comparable to the EU for personal data transferred to certified U.S. companies, a mechanism intended to address the cross-border transfer issues previously found unlawful in Google Analytics-related GDPR rulings.
On January 13, 2022, Austria's Datenschutzbehörde (DSB) ruled that a website's continuous use of Google Analytics, and the resulting export of personal data to the United States, violates the GDPR's data export requirements.
On February 10, 2022, France's data protection authority (CNIL) found that data collection and transfers to the United States using Google Analytics 'are illegal,' in violation of Article 44 of the GDPR, and ordered a French website operator to bring its processing into compliance.
The Google Analytics Terms of Service require that a site or app's privacy policy provide notice of the use of cookies and mobile device identifiers, such as the Android Advertising Identifier or Advertising Identifier for iOS, used by Analytics to collect data.
Google's own product documentation states that Analytics customers can select how long user-level and event-level data is stored before it is scheduled for automatic deletion from the Analytics account and Google's servers, indicating that granular behavioral data is retained by default until a customer-configured period elapses.
Alphabet Inc.'s most recent annual Form 10-K filing defines the terms 'Alphabet,' 'the company,' 'we,' 'us,' and 'our' to include Alphabet Inc. and its subsidiaries, and states that Google and Alphabet trademarks are Alphabet's property, publicly documenting the parent-subsidiary relationship that includes the Google Analytics product line.
Alphabet Inc.'s SEC Form 10-K filing states that, as a result of a 2015 holding company reorganization, Alphabet Inc. became the successor issuer to Google, which now operates beneath Alphabet's corporate structure.
The Google Analytics Terms of Service state that Google will not share a customer's data with third parties except where the customer has consented, where required by law or believed necessary to protect rights or safety, or through service providers bound to process data only on Google's instructions under confidentiality obligations.
Google's privacy policy discloses that it uses data about the ads a user interacts with, including related Google Search activity, to help advertisers understand ad campaign performance, and states that over 2 million non-Google websites and apps partner with Google to show ads.
On February 10, 2022, France's data protection authority (CNIL) found that data collection and transfers to the United States using Google Analytics 'are illegal,' in violation of Article 44 of the GDPR, and ordered a French website operator to bring its processing into compliance.
On January 13, 2022, Austria's Datenschutzbehörde (DSB) ruled that a website's continuous use of Google Analytics, and the resulting export of personal data to the United States, violates the GDPR's data export requirements.
On July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework, concluding that the United States ensures a level of data protection comparable to the EU for personal data transferred to certified U.S. companies, a mechanism intended to address the cross-border transfer issues previously found unlawful in Google Analytics-related GDPR rulings.
Google's privacy policy discloses that data generated through Google Analytics can be linked, by both the Analytics customer and by Google, to cookies and other technologies tied to a user's visits to other websites and apps.