analytics in europe: rulings, decision tree, myths

web · 2026-10-13 · 6 min

no blanket ban, no blanket permission — the oversimplified claims ranking around you are both wrong. austrian, french and italian regulators ruled SPECIFIC analytics transfers/setups unlawful (post-schrems II); the 2023 EU-US data privacy framework changed transfer context; google claims DPF compliance without settling YOUR consent, configuration, or national rules. the nuanced decision tree vendor blogs won't write (they sell the alternative).

what the rulings actually decided

austria (noyb complaint): a specific GA setup's US transfer violated GDPR. france (CNIL): three controllers ordered to comply; analytics trackers need consent UNLESS narrow exemption (limited purpose, information + opt-out, no cross-site/file combination, IP truncation, lifetime limits — most large offerings don't auto-qualify). italy: same direction via garante. none banned analytics as such; all judged configurations AND transfers. the framework since: DPF eases transfers, touches nothing about consent or minimization.

your decision tree (not legal advice)

EU/UK visitors + GA4 default setup: consent banner BEFORE tags fire, IP/anonymization settings reviewed, data retention minimized, DPA signed with google, transfer documentation current. OR: privacy-light counter (plausible/matomo-style: fewer identifiers, simpler story — still verify against YOUR visitors' law; privacy-focused is a claim, not a verdict). OR: no analytics until revenue justifies the homework (do I need analytics). each branch needs: banner/consent where required (cookie post), policy describing reality (privacy policy), vendor DPAs filed.

what competitors get wrong

vendors: analytics-is-illegal (sells their tool) vs google-fan blogs: just-click-accept (sells complacency). both skip: national differences (CNIL ≠ garante ≠ ICO — same GDPR, different enforcement), configuration dependence (two GA4 installs, two verdicts), and the documented alternative (CNIL's exemption checklist is public — measure YOUR setup against it instead of debating headlines).

FAQ

switch tools and forget?

no: migration changes identifiers and transfers, not obligations. inventory (GDPR simply) first, tool second.

fines for a plumber's site?

maximums terrify, patterns prosecute: complaints, orders to fix, processor trouble arrive before fines. proportionate homework beats both panic and negligence — ask a qualified lawyer for verdicts, not blogs.