https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply Skip to main content PUBLICATIONS | Glossary | FR-EN | Cookies management Retourner a l'accueil CNIL.FR To protect personal data, support innovation, preserve individual liberties Logo CNIL Small Logo CNIL Small Loupe de recherche --------------------------------------------------------------------- My compliance tools GDPR toolkit --------------------------------------------------------------------- Data protection Personal Data : definition Digital rights of children The right to de-listing in questions Official Texts --------------------------------------------------------------------- Topics News Documents Glossary --------------------------------------------------------------------- The CNIL The CNIL's Missions Status & Composition Investigating and issuing sanctions Around the world --------------------------------------------------------------------- FR|EN * My compliance tools * Data protection * Topics * The CNIL * * GDPR toolkit --------------------------------------------------------------------- * Record of processing activities * Privacy Impact assessment (PIA) * Code of conduct Fermer Personal Data : definition --------------------------------------------------------------------- Digital rights of children --------------------------------------------------------------------- The right to de-listing in questions --------------------------------------------------------------------- Official Texts --------------------------------------------------------------------- Fermer News --------------------------------------------------------------------- Documents --------------------------------------------------------------------- Glossary --------------------------------------------------------------------- Fermer The CNIL's Missions --------------------------------------------------------------------- Status & Composition --------------------------------------------------------------------- Investigating and issuing sanctions --------------------------------------------------------------------- * The steps of the CNIL's law enforcement process * How does the CNIL conduct its investigations? * The sanctions procedure Around the world --------------------------------------------------------------------- * The EDPB * Map of the data protection around the world * The CNIL Worldwide * Law enforcement Fermer [ ] Loupe de recherche Recherche Ma selection j'accede au formulaire Fil d ariane > Use of Google Analytics and data transfers to the United States: the CNIL orders a website manager/operator to comply Decrease the size of the font Increase the size of the font Print the article Use of Google Analytics and data transfers to the United States: the CNIL orders a website manager/operator to comply 10 February 2022 --------------------------------------------------------------------- Google Analytics provides statistics on website traffic. After receiving complaints from the NOYB association, the CNIL, in cooperation with its European counterparts, analysed the conditions under which the data collected through this service is transferred to the United States. The CNIL considers that these transfers are illegal and orders a French website manager to comply with the GDPR and, if necessary, to stop using this service under the current conditions. Google Analytics is a service that can be integrated by websites such as online sale sites in order to measure the number of visits by Internet users. In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States. The CNIL received several complaints from the NOYB association concerning the transfer to the United States of data collected during visits to websites using Google Analytics. In total, 101 complaints were filed by NOYB in the 27 EU Member States and the three other European Economic Area (EEA) states against 101 data controllers allegedly transferring personal data to the US. An analysis at European level The CNIL, in cooperation with its European counterparts, analysed the conditions under which data collected through the use of Google Analytics was transferred to the United States and the risks incurred for the individuals concerned. The aim is to collectively draw the consequences of the "Schrems II" judgment of the Court of Justice of the European Union of 16 July 2020, which invalidated the Privacy Shield. The CJEU had highlighted the risk that American intelligence services would access personal data transferred to the United States if the transfers were not properly regulated. Consequences in France The CNIL concludes that transfers to the United States are currently not sufficiently regulated. Indeed, in the absence of an adequacy decision (which would establish that this country offers a sufficient level of data protection with regard to the GDPR) concerning transfers to the United States, the transfer of data can only take place if appropriate guarantees are provided for this flow in particular. However, the CNIL found that this was not the case. Indeed, although Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for US intelligence services. There is therefore a risk for French website users who use this service and whose data is exported. The CNIL notes that the data of Internet users is thus transferred to the United States in violation of Articles 44 et seq. of the GDPR. The CNIL therefore ordered to the website manager to bring this processing into compliance with the GDPR, if necessary by ceasing to use the Google Analytics functionality (under the current conditions) or by using a tool that does not involve a transfer outside the EU. The website operator in question has one month to comply. Regarding website audience measurement and analysis services, the CNIL recommends that these tools should only be used to produce anonymous statistical data, thus allowing for an exemption from consent if the data controller ensures that there are no illegal transfers. The CNIL has launched an evaluation programme to determine which solutions are exempt from consent. The CNIL has issued other orders to comply to website operators using Google Analytics. The investigation by the CNIL and its counterparts also extends to other tools used by sites that result in the transfer of data of European Internet users to the United States. Corrective measures in this respect may be adopted in the near future. Texte reference Read more > The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield (PDF, 322 ko) - CJEU [dw-doc] > Alternatives to third-party cookies: what consequences regarding consent? [dw-doc] > [FR] Utilisation de Google Analytics et transferts de donnees vers les Etats-Unis : la CNIL met en demeure un gestionnaire de site web [dw-doc] Texte reference Official texts > Chapter V of the GDPR - Transfers of personal data to third countries of international organisations - EUR-Lex [dw-doc] Keywords associated to this article * #International data transfers * #Order to comply This can also interest you ... 2021 - a year of records for the CNIL 2021, a record year for the CNIL's enforcement action 04 February 2022 Sanction Refusing cookies should be as easy as accepting them: the CNIL continues its action and issues new orders Since May 2021, the CNIL issued orders to around sixty players that do not make refusing cookies as easily as accepting them. The CNIL has continued its investigations, following ... 14 December 2021 Order to comply Refusing cookies should be as easy as accepting them: results of the second campaign of orders and future actions At the end of June, the CNIL issued orders to around forty players that still do not make refusing cookies as easy as accepting them. 80% of the players concerned have brought ... 14 September 2021 Order to comply Logo CNIL footer Commission Nationale de l'Informatique et des Libertes Follow us Twitter * PUBLICATIONS * Glossary * FR|EN * Cookies management My compliance tools * GDPR toolkit --------------------------------------------------------------------- The CNIL * The CNIL's Missions * Status & Composition * Investigating and issuing sanctions * Around the world Data protection * Personal Data : definition * Digital rights of children * The right to de-listing in questions * Official Texts --------------------------------------------------------------------- Topics * News * Documents * Glossary --------------------------------------------------------------------- Contact the CNIL