Google Analytics and EU Privacy Law: The Timeline (2015-2026)

Last checked: October 27, 2026. Each entry links to the decision or to a report of it.

The legal status of Google Analytics in Europe has flipped multiple times in a decade, and each flip followed the same sequence: a transfer framework dies in court, regulators apply the ruling to the most visible US tool on the web, and a migration wave follows. Here is the whole sequence, in order.

2015: The first domino

October 6, 2015: Schrems I. The CJEU invalidates Safe Harbor, the original EU-US data transfer agreement, ruling that US surveillance law (as revealed by Snowden) is incompatible with EU fundamental rights. Companies that relied on it, Google included, move to Standard Contractual Clauses.

2016-2018: The rebuild

July 12, 2016. The Privacy Shield framework replaces Safe Harbor. Its critics, Max Schrems among them, argue from the start that it does not fix the problems the court identified.

May 25, 2018. The GDPR becomes applicable. Analytics is now squarely "processing of personal data" wherever identifiers or IPs are involved.

2020: The second domino

July 16, 2020: Schrems II. The CJEU invalidates Privacy Shield, same core reasoning: no effective redress for EU citizens against US surveillance. Crucially, the court adds that SCCs cannot contractually fix US law, which removes the fallback for tools like Google Analytics.

August 17, 2020. Max Schrems' organization noyb files 101 complaints across EU and EEA member states against websites using Google Analytics and Facebook Connect, deliberately forcing every national regulator to apply Schrems II to a concrete tool. The complaints are the engine of everything in 2022.

2022: The enforcement wave

January 2022: Austria. The Austrian data protection authority (DSB) rules, on one of the noyb complaints, that a website's use of Google Analytics violated the GDPR: the transfers to Google US lacked a valid basis, and Google's supplementary measures (including IP anonymization settings) were insufficient. The first "Google Analytics is unlawful" decision in the EU.

January 2022: EDPS v. European Parliament. The European Data Protection Supervisor reprimands the European Parliament itself over a COVID-testing website using Google Analytics and Stripe. Symbolically perfect: even the EU's own institutions failed the test.

February 10, 2022: France. The CNIL orders a French website to bring its use of Google Analytics into compliance within a month, if necessary by stopping it: the transfers are unlawful and Google's additional measures do not prevent access by US intelligence services. The CNIL later published guidance describing the only setup it considered workable, a proxy under strict conditions.

June 23, 2022: Italy. The Garante reaches the same conclusion on the same legal logic, gives the website 90 days to comply and warns every Italian site using the tool. Austria, France and Italy now align.

2023: The fines, then the truce

July 3, 2023: Sweden. The IMY issues fines for Google Analytics use: 12 million SEK (about $1.1M) against Tele2 and 300,000 SEK against retailer CDON, and orders two other companies to stop using the tool.

July 10, 2023: The truce. The European Commission adopts the adequacy decision for the EU-US Data Privacy Framework (DPF). Transfers to certified US companies, Google included, are lawful again. The 2022 decisions are not erased, they were correct on the law as it stood, but the ground under them shifts: transfers of the kind they condemned have a valid basis again going forward, and the migration pressure deflates.

2023-2025: The third challenge forms

September 2023. French MP Philippe Latombe files a direct annulment action against the DPF before the EU General Court (T-553/23) ↗.

September 3, 2025. The General Court upholds the DPF, finding the new US redress mechanism (the Data Protection Review Court) sufficient. First judicial test survived.

October 31, 2025. Latombe appeals to the CJEU (Case C-703/25 P), the court that struck down both previous frameworks.

2026: Where we are now

As of October 27, 2026: the DPF is valid, Google Analytics is lawful to use in the EU under it, and the appeal is pending with no hearing date we could find ↗. The pattern above has run twice: framework adopted, framework challenged, framework invalidated, Google Analytics decisions within two years. Whether it runs a third time is in the CJEU's hands; the case page keeps a dated log of each step ↗.

The lesson the timeline teaches

A migration planned before a ruling is cheaper than one forced after it. That asymmetry is the strategic point: preparing costs little (knowing your transfers, keeping data portable, choosing tools that give you the smallest possible stake in the next ruling ↗), while reacting costs a fire drill plus years of stranded data. The timeline will get its next entry; the only question is which side of it you are on when it does.

Read the decisions again and one detail jumps out: every order in 2022 landed on a website, not on Google. The tool was the subject of the analysis; the site owner was the one who had to act. That is the part worth internalizing before the next entry, because it will work the same way.

Where Datalenk stands. Datalenk writes nothing to the visitor's device by default and keeps its servers and databases in the European Union (Hetzner); the details, what waits for the visitor's consent, and what changes with the optional persistent layer, are on the ↗ page.

FAQ

Has anyone been fined over Google Analytics? Yes, but the fines landed on the websites using it, not on Google. Sweden's IMY fined Tele2 12 million SEK in July 2023, and retailer CDON 300,000 SEK, for their own use of the tool. The 2022 decisions in Austria, France and Italy worked the same way: they were orders against site operators, not sanctions against Google. The pressure eased when the 2023 Data Privacy Framework restored a legal basis for the transfers going forward, which is precisely why the appeal against that framework matters.

Is Google Analytics illegal in Europe right now? No. It is lawful under the DPF as of October 2026. The framework is under appeal at the CJEU; the timeline above is why that appeal matters.

What happened to the 101 noyb complaints? They produced the 2022 decisions in Austria, France, Italy and, in 2023, the Swedish fines, which found that settings such as IP anonymization did not cure the transfers. The reasoning can be reused if the DPF falls.

What should I watch next? Case C-703/25 P (the Latombe appeal). Its status and a dated log are on the case page ↗.