Norway may soon join the list of EU countries banning Google Analytics following an initial conclusion that it violates the GDPR.
Google Analytics has increasingly come under fire by EU jurisdictions, accused of violating European data protection laws, specifically the GDPR. According to Simple Analytics, the Norwegian data protection authority (Datatilsynet) has issued a preliminary decision that “the use of Google Analytics was in violation of the GDPR’s transfer rules.”
At the heart of the issue is a 2020 EU ruling that US cloud providers are not in compliance with the GDPR. There have long been concerns regarding the transmission of EU user data to US cloud providers, especially given US cloud providers’ obligation to assist US intelligence agencies.
When Austria became one of the first jurisdictions to issue an adverse ruling against Google Analytics, Max Schrems, honorary chair of The European Center for Digital Rights (noyb), predicted it would simply be the first of many such rulings.
“We expect similar decisions to now drop gradually in most EU member states,” Schrems said. “We have filed 101 complaints in almost all Member States and the authorities coordinated the response. A similar decision was also issued by the European Data Protection Supervisor last week.
“This is a very detailed and sound decision,” Schrems continued. “The bottom line is: Companies can’t use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.”
As Simple Analytics points out, it is possible — although unlikely — that Norway’s final conclusion will differ from its initial conclusion. If Norway’s final decision is in line with its preliminary one, it will join Austria, Denmark, Finland, France, and Italy, all of whom have ruled against Google.