For a few months in 2022, it looked like Google Analytics was about to become unusable in Europe. One regulator after another found that a standard installation violated GDPR, and the Dutch data protection authority publicly warned website owners that using it might soon not be allowed.
Then, in July 2023, the EU and US agreed a new data transfer framework, and the conversation went quiet. Many site owners assumed the problem had been solved and moved on.
The Data Privacy Framework addresses international transfers to participating US companies. It doesn't settle cookie consent, data minimization, or the lawful basis for collecting analytics data. Those still need to be assessed separately.
Why Google Analytics became a GDPR problem
The trouble started with the Schrems II ruling in July 2020. The Court of Justice of the EU struck down the EU-US Privacy Shield, finding that US surveillance laws didn't give Europeans protection essentially equivalent to what GDPR requires. Companies could still use Standard Contractual Clauses for transfers, but only if they assessed the destination country's laws and added supplementary measures where needed.
A month later, the privacy group noyb filed 101 complaints across the EU against websites that kept sending visitor data to Google and Facebook. Those complaints landed with national regulators, who had to decide whether a typical Google Analytics setup could meet the post-Schrems II bar.
The core issue was simple. Google Analytics collects identifiers like cookie IDs and IP addresses, which count as personal data under GDPR. That data went to Google LLC, a US company subject to US surveillance laws, and the regulators had to decide whether Google's safeguards were enough.
What the regulators decided
Austria's data protection authority went first. In January 2022, it ruled that a health website's use of Google Analytics violated GDPR's rules on international transfers, finding that Google's supplementary measures, including encryption and IP anonymization, didn't prevent US authorities from accessing the data.
France's CNIL followed in February 2022 with a formal notice to a website operator, and later published guidance saying Google Analytics as configured couldn't be used lawfully. It suggested a proxy setup that stripped identifying data before it reached Google as one possible workaround, while acknowledging it was complex.
Italy's Garante reached the same conclusion in June 2022 and gave the controller in that case 90 days to comply. Denmark's Datatilsynet issued guidance that autumn telling organizations to stop using the tool unless they could add effective supplementary measures. Sweden's IMY went further in July 2023, issuing fines against companies including Tele2, which was fined 12 million Swedish kronor.
The Dutch position
The Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, warned in 2022 about the transfer issue while investigating complaints. That historical warning should not be presented as an EU-wide or current GA4 ban. In early 2022 it said it was investigating two complaints about Google Analytics and warned that use of the tool might soon not be permitted. It advised organizations to consider alternatives.
That warning carried weight for Dutch businesses, many of whom started migrating to privacy-friendly analytics. The AP also maintains a long-standing position on analytics cookies under the Dutch Telecommunications Act: cookies used purely for analytics with little or no privacy impact can be exempt from consent, but only when configured in a privacy-friendly way. A default Google Analytics setup that shares data with other Google services doesn't fit that exemption.
The July 2023 adequacy decision changed the legal context for transfers. It did not decide every cookie-consent or analytics-processing question.
What the EU-US Data Privacy Framework changed
On 10 July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. It finds that the US provides adequate protection for personal data transferred to companies certified under the Framework, based on new limits on US intelligence access and a redress mechanism for Europeans.
For transfers to a recipient with an active certification covering the data, the Framework offers an Article 45 transfer mechanism. Check Google's current certification and contractual recipient before relying on it. This is separate from the Article 6 lawful basis for collecting and using analytics data.
That directly addresses the reasoning in the 2022 rulings, which were all about the lack of adequate transfer protection. A regulator applying those decisions today would need to account for the adequacy decision, while the remaining processing and consent obligations still require a separate assessment.
What it didn't change
The Framework is the third transatlantic arrangement of its kind. Safe Harbor was struck down in 2015 and Privacy Shield in 2020. The new Framework survived its first challenge in September 2025, when the EU General Court dismissed a case brought by a French MP, and an appeal was filed as Case C-703/25 P. An appeal does not itself suspend the adequacy decision. Any later invalidation would require assessing the judgment, available safeguards, and any transition arrangements rather than assuming an identical return to 2022.
Transfers were only ever one issue. GDPR still requires a lawful basis for the processing itself, data minimization, transparency in your privacy policy, and a data processing arrangement with Google. And under the ePrivacy rules, placing Google Analytics cookies generally requires consent, which is a separate question from transfers and one the Framework doesn't touch.
There's also the question of what you're comfortable with. A US-headquartered provider stays subject to US legal process regardless of the adequacy decision, and some businesses, especially in health, legal, or public sector work, prefer not to depend on that.
So, is Google Analytics legal in the EU right now?
As of October 2026, using Google Analytics in the EU can be lawful, provided you meet the conditions. The Commission continues to describe the Data Privacy Framework as a transfer mechanism for participating US recipients, and you need to get consent for the cookies, configure the tool sensibly, disclose it properly, and have Google's data processing terms in place.
What you can't do is treat it as a settled, risk-free choice. The legal basis depends on a framework under appeal, cookie consent is required in practice, and consent choices make reporting incomplete. Advanced Consent Mode can send cookieless pings and produce modeled reports, so declining consent does not necessarily mean zero measurement or zero data transmission.
That last point is often the practical deciding factor. Many sites see a significant share of visitors reject analytics cookies, which means Google Analytics data in the EU is already incomplete before any legal question comes up.
If you keep Google Analytics, configure it carefully
Use a proper consent management setup that blocks Google Analytics until the visitor opts in. Google's Consent Mode v2 is required for using certain advertising features with EEA traffic, and it's worth understanding what it sends before consent, since cookieless pings still transmit some data.
Review your data settings. Set the shortest data retention period that works for your reporting, disable Google Signals unless you have a specific need, turn off data sharing with other Google products, and avoid sending personal data like email addresses in URLs or event parameters.
Document the decision. Your privacy policy should name Google Analytics, explain what it collects and why, mention the international transfer and its legal basis, and tell visitors how to withdraw consent.
The alternative: Privacy-friendly analytics
Many European businesses decided the simpler path was to stop sending visitor data to a US company at all. Privacy-friendly tools like Plausible, Matomo, and Umami take different approaches, but they share a focus on collecting less and keeping data under your control.
Self-hosting goes furthest. Running analytics on an EU server can reduce third-party data flows, but verify the hosting provider, subprocessors, remote support, backups, and outbound integrations. Self-hosting does not automatically eliminate third-party access or international transfers. We've covered how to self-host Plausible step by step, and Matomo and Umami are similarly straightforward with Docker.
Some of these tools can also be configured to avoid cookies entirely, which may reduce or remove the need for a consent banner depending on your jurisdiction and setup. France's CNIL, for example, has a consent exemption for audience measurement tools that meet strict conditions, and the Dutch AP's exemption for low-impact analytics cookies follows similar logic. Check your own regulator's guidance before dropping the banner, since the rules vary by country.
How to decide what's right for your site
Ask what you actually use. If your team looks at pageviews, top pages, referrers, and conversions, a lightweight privacy-friendly tool covers that well. If you depend on Google Ads integration, audience building, or cross-device reporting, Google Analytics does things the alternatives don't.
Consider your sector. Health, finance, legal, public sector, and services aimed at children carry more regulatory scrutiny and more sensitive data, which shifts the calculation toward keeping data in-house.
Think about resilience. If the Data Privacy Framework is invalidated, would you need to switch analytics tools in a hurry? Choosing a tool that doesn't depend on transatlantic transfers removes that risk entirely.
Wrapping up
The 2022 rulings from Austria, France, Italy, and Denmark, along with the Dutch AP's warning, were driven by the lack of a valid transfer mechanism. The EU-US Data Privacy Framework fixed that for now, which makes Google Analytics usable in the EU with consent and careful configuration. It didn't make it risk-free, and the Framework's future still rests with the Court of Justice.
For many European sites, especially those already frustrated by consent banners and incomplete data, privacy-friendly analytics on your own infrastructure is the cleaner long-term answer.
Thanks for reading! If you'd like to run your own analytics under EU jurisdiction, QDE provides unmanaged KVM VPS hosting in Amsterdam, with GDPR-compliant infrastructure, minimal data collection, and full root access to self-host tools like Plausible, Matomo, or Umami.
Want help choosing a plan? Contact our team anytime.
Frequently asked questions about Google Analytics and GDPR
Is Google Analytics banned in the EU?
No. There's no EU-wide ban. Several regulators found in 2022 that specific setups violated GDPR's transfer rules, but the EU-US Data Privacy Framework adopted in July 2023 now gives transfers to certified companies like Google a legal basis.
Do I need cookie consent for Google Analytics?
In practice, yes. Google Analytics cookies are generally treated as non-essential under the ePrivacy rules, so you need opt-in consent before they're set. This applies regardless of the Data Privacy Framework.
What did the Dutch Data Protection Authority say about Google Analytics?
In 2022, the Autoriteit Persoonsgegevens said it was investigating complaints and warned that Google Analytics might soon not be allowed. That warning concerned the legal context before the Data Privacy Framework and is not itself a current blanket ban on GA4.
Is GA4 more GDPR-compliant than Universal Analytics?
Google documents that GA4 does not log or store individual IP addresses from EU users, although it uses them for coarse location derivation before discarding them. GA4 also provides retention controls. It still sends data to Google, uses cookies that need consent, and requires an applicable transfer mechanism for data sent outside the EEA; the Data Privacy Framework is one option for covered certified recipients.
What happens to Google Analytics if the Data Privacy Framework is struck down?
Sites relying on that decision would need to assess the judgment and their other transfer mechanisms. Standard Contractual Clauses, supplementary safeguards, and any transitional arrangements would need a current assessment; the outcome would not automatically duplicate 2022.
What's the most privacy-friendly alternative to Google Analytics?
Self-hosted Plausible, Matomo, or Umami can give you more control over data collection. Check hosting access, subprocessors, and integrations; an EU server alone does not guarantee no international transfers. Cookie-free operation also does not automatically remove all privacy obligations.