GDPR: the CNIL orders websites to stop using Google Analytics as it stands

A blow for Google: in an official statement from the CNIL (in French), the French data protection authority, we learn of a major problem regarding the privacy of visitors to websites that use Google Analytics. All website operators are required to comply within one month – in other words, to stop using Google's tool. Plenty of work ahead for webmasters. Here is what it means.

Google Analytics vs GDPR: the problem

The NOYB association filed several complaints about Google Analytics with the CNIL.

When someone visits a website using Google Analytics, a unique identifier is generated for each visitor and visit data is transferred to the United States. The CNIL considers that these transfers are "not sufficiently regulated at present" in terms of data protection, which is therefore deemed insufficient under the GDPR.

"The CNIL notes that internet users' data is thus transferred to the United States in breach of Articles 44 et seq. of the GDPR."

In Europe

At European level, NOYB has filed 101 complaints across the 27 EU member states.

In July 2020 (in French), the CJEU (Court of Justice of the European Union) had highlighted "the risk of US intelligence services accessing personal data transferred to the United States", which appears to have contributed to the CNIL's conclusion.

In France: consequences for webmasters

The CNIL's statement (in French) is explicit: website operators have one month to comply and stop using Google Analytics as it stands:

"[…] The CNIL therefore orders the website operator to bring this processing into line with the GDPR, if necessary by ceasing to use the Google Analytics functionality (under the current conditions) or by using a tool that does not involve any transfer outside the EU. The website operator concerned has one month to comply."

What are the alternatives?

The CNIL states: "As regards website audience measurement and analysis services, the CNIL recommends that these tools be used solely to produce anonymous statistical data, thereby allowing an exemption from consent provided the data controller ensures that there are no unlawful transfers." (links in French)

Matomo appears to be a viable alternative to Google Analytics that meets the CNIL's criteria.

Their pitch: "You could lose your customers' trust and damage your reputation if people find out that their data is being used for Google's 'own purposes'. By choosing the ethical alternative, Matomo, you make no sacrifices on privacy and do not compromise your website. You can even use Matomo without having to ask for consent."

The ultimate in privacy: Matomo can apparently be self-hosted. The HaiSoft team is raring to go and test the solution.

Sources

CNIL statement (in French): https://www.cnil.fr/fr/utilisation-de-google-analytics-et-transferts-de-donnees-vers-les-etats-unis-la-cnil-met-en-demeure
Matomo article (in English): https://fr.matomo.org/blog/2022/02/france-google-analytics-gdpr-breach/