Last month, the French national commission announced Google analytics was declared illegal...
… concerning the European law on protecting private data (RGPD). Except that Google Analytics is the most used analytics tool in the world: it’s 70% of the French market and 75% of the world market... yeah, that’s what we call a market monopoly, my friends 🙂
So if you manage a website or one of your company, you are likely to ask yourself many questions. Don’t worry; we’re going to review the main ones together.
But first of all, to clarify: The CNIL is the french national commission that protects Internet users’ freedom and private data. And this commission has decided to issue a formal notice, which means that Google has a limited period (1 month) to comply with the law before the sanctions fall. Either host the data only in the EU or make the data transfer with the USA compatible with the European regulations.
…with a high risk of being used for advertising purposes or directly by the American intelligence services. And all this without the explicit consent of European Internet users.
First of all, which data are sent to the US? IP addresses, browser data, website information, and unique online identifiers. The big problem is to allow a single entity holding all this information to identify an individual! And here we enter the illegality.
So you might answer me, but how come my data is sent to the USA?
First of all, you should know that you are using a free tool! And that consequently there is a counterpart to this use. And it goes through the collection of your data. By installing GA, you agree that visitor data will be collected and sent to the USA for “Analysis.”
But okay, let’s take a little time to look at this in more detail. When you arrive at a site that uses Google Analytics, this is what happens:
- Your computer stores your information in an HTML cookie (a small text file).
- This data is also collected by the analytics tool through your intermediate browser.
- Then, the data is stored in a database, in this case, Big Query.
The CNIL has judged that the transfer of data to the United States is, for the moment, not sufficiently regulated.
If we go back in time, there's nothing new on this topic because Google didn't respect the rules since 2018 and the official release of GDPR...
Companies knew this very well. For example, the data stored was in the US and not Europe. I remember the debates I had with Google in the names of customers … But what to do to fight against the American giant when we do not weigh heavily in its turnover. But when a tool occupies nearly 70% of the market share, it is difficult to make it comply with “local” regulations without coordination. And on this subject, we are talking about a European scale so that it has enough weight.
For many years Google has played the card of misinformation about its “good” compliance with the RGPD.
A “Privacy Shield” was put in place in August 2016. So before the launch of the RGPD. The European Commission had recognized it as providing adequate protection to personal data transferred from a European entity to companies established in the United States …
And it was not until July 2020 that the European Court of Justice canceled this “Privacy Shield.“ 2 years after the launch of the RGPD… Thanks to the lobbies 🙂
Google France makes efforts with the parent company to change things. New features allowing more transparency on data collection and storage are launched on the Google Analytics side.
The recent announcement by France is not random. It follows the one from Austria...
Nothing is random when the CNIL officializes its formal notice early February 2022 on the subject.This follows the position taken by Austria at the beginning of 2022; Germany will soon do the same as well as Denmark and Norway.
We are finally starting to take a multi-country position.
This is, in my opinion, a political pressure game. It finally takes a significant dimension to force Google’s hand. It remains to be seen who will win this arm-wrestling match, especially if the fight will be played out at the European level. Otherwise, France alone will not be able to face Google.
So you have two main options: Keep GA in place or switch for a GDPR friendly analytic tool
– Option 1: Keep Google Analytics in place until Google complies. When a tool occupies such a prominent place on the market, you can imagine that the CNIL will have a hard time putting all the sites that use it on notice. This solution is probably the best for any company with a significant history and size. For example, if your company already has more than two years of data history with a volume of visits > 5 000/month.
– Option 2: Take the opportunity to switch to an RGPD-friendly tool like Matomo or Analytics Suite 2 from AT Internet or Fathom. You can also market this to your customers and prospects. Additional proof of your concern about the protection of their private data. This solution seems to be interesting for new businesses.
Existing companies with a low data history or companies whose marketing positioning is consistent with using an RGPD friendly tool. We are, therefore, in situations where the stakes remain low—no significant loss of data history.
The US and the UE are working on a new protocol of data transfer, so the story is to be continued :-)....
The recent formal notice from the CNIL is, therefore, for me, far from being as alarming as it seems.
We are essentially dealing with political arm wrestling. A balance of power that is finally becoming officially clearer after more than four years of immobility of France. Because since May 2018, no clear position has been given while everyone knows that Google does not play by the same rules.
And in the meantime, you have the choice to keep Google Analytics in place simply. Or capitalize on the news to communicate about your change of tools to your customers.
About us
We are a collective of experts providing online & offline courses in digital marketing and digital transformation for future/current professionals
Our mission is to help you get the skills you need in digital to achieve two things:
- Get job-ready for the current work market
- Build your business autonomously
We ‘ve included in all our courses three key components: practices, real-life examples, and illustrative theory.