Schrems III: Will Google Analytics Become Illegal in the EU (Again)?

Last checked: October 27, 2026. The court case itself, step by step with sources, is on its own page ↗.

If you run analytics on a website with European visitors, you have probably seen the headlines: "Schrems III is coming", "the end of EU-US data transfers", "Google Analytics about to be illegal again". Some of those articles are useful; some are fear marketing dressed up as legal analysis.

Here is the situation as it stands, with a link to the source for each step, and what the last ten years of European privacy litigation suggest happens next.

Where things stand today (the verified version)

Three facts define where things stand legally:

1. The EU-US Data Privacy Framework (DPF) is valid today. The European Commission adopted its adequacy decision for the DPF on July 10, 2023. Companies certified under it, including Google, can lawfully transfer EU personal data to the United States. Using Google Analytics in the EU is not illegal as of this writing.

2. The DPF survived its first court challenge, but the appeal is live. French member of parliament Philippe Latombe challenged the adequacy decision directly. On September 3, 2025, the EU General Court upheld the DPF and dismissed his case (Latombe v. Commission). Latombe appealed to the Court of Justice of the EU on October 31, 2025, as Case C-703/25 P. On October 27, 2026 we found no hearing date announced.

3. The activist behind the last two rulings is watching. noyb, the privacy organization founded by Max Schrems, said it was "very surprised" by the General Court's judgment and would analyse it (quoted by Lewis Silkin). Schrems' two previous challenges are the reason this article has a "III" in the title.

So no, there has been no "Schrems III ruling". What exists is a pending appeal and a legal framework with two struck-down predecessors.

The pattern: this movie has played twice before

The reason serious companies prepare anyway is the historical base rate. Both previous EU-US transfer frameworks were invalidated by the same court that now holds the DPF appeal.

Schrems I (October 6, 2015). The CJEU invalidated Safe Harbor, the original EU-US transfer agreement, after Max Schrems challenged Facebook's transfers in the wake of the Snowden revelations. Companies relying on it lost that legal basis for transatlantic data flows overnight.

Schrems II (July 16, 2020). Its replacement, Privacy Shield, lasted four years. The CJEU struck it down on the same core ground: US surveillance law gives EU citizens no effective remedy, so the US does not offer "essentially equivalent" protection.

The aftershock that hit analytics directly (2022). Schrems II is what made Google Analytics a named target. noyb filed 101 complaints across the EU and EEA in August 2020, and data protection authorities started ruling one by one: the Austrian DSB in January 2022, the French CNIL in February 2022, the Italian Garante in June 2022, each concluding that the website's Google Analytics transfers violated the GDPR. Sites were ordered to stop or fix them.

The pattern in one sentence: framework adopted, framework challenged, framework invalidated, regulators turn the abstract ruling into concrete enforcement against specific tools, and Google Analytics has been the highest-profile casualty both times.

The DPF's defenders argue this time is different: the US created a Data Protection Review Court and new redress mechanisms specifically to fix the Schrems II defects, and the General Court found them sufficient. The appeal will test exactly that question. There is also a wildcard the previous rounds did not have: the redress mechanism depends on US executive orders that can be amended by any administration, which keeps the "essential equivalence" question permanently unstable.

What happens to Google Analytics if the DPF falls

If the CJEU invalidates the adequacy decision, the mechanics are well rehearsed by now:

1. Transfers lose their primary legal basis immediately. The CJEU gave no transition period in Schrems II.
2. Companies fall back on Standard Contractual Clauses (SCCs). But Schrems II also held that SCCs cannot fix US surveillance law by contract, which is why the 2022 decisions found the Google Analytics transfers unlawful even with SCCs in place.
3. DPAs can reuse the 2022 reasoning. The complaints and legal analysis already exist: after Schrems II (July 2020), the first Google Analytics decision came in January 2022.
4. The practical question for site owners becomes the same one from 2022: can you configure a US-owned analytics tool into compliance (IP anonymization, proxying, consent), or is the only durable answer a tool that never sends data to a US-controlled company at all? French and Austrian regulators took a hard line last time: settings such as IP anonymization were not enough. The CNIL did describe a proxy setup that can work, under strict conditions (no IP sent to the vendor, identifiers replaced, referrer and URL parameters stripped, hosting outside US reach).

None of this requires Google Analytics to be "banned". It requires only that its data transfers lack a valid legal basis, at which point every EU site using it inherits a compliance problem.

The timeline

No date has been announced for the CJEU's decision, and anyone selling you urgency with a specific date is guessing. What the history means strategically: you have time to prepare calmly, and little time to waste if the ruling goes against the DPF.

How to be ready (whatever the court decides)

The preparation that makes sense is the kind that pays off even if the DPF survives, because it also reduces your US data flows today.

Step 1: inventory your US data transfers. List every tool on your site that sends visitor data to a US-owned company: analytics, tag managers, heatmaps, session replay, A/B testing, fonts, CDNs. For each one, note what personal data leaves and under which legal basis.

Step 2: classify by replaceability. Analytics is usually the easiest high-impact swap: mature EU-hosted alternatives exist at every price point ↗, and unlike your payment processor, switching analytics does not touch revenue-critical infrastructure.

Step 3: prefer tools that shrink the question. An analytics tool whose default mode writes nothing to the visitor's device, stores no raw IP and keeps all visitor data on EU-owned infrastructure has almost no stake in the case. Ask any vendor two questions: what exactly is written to the device in the default configuration, and which of your sub-processors are US-owned. Those two answers tell you more than any compliance badge. That is the difference between betting on a court outcome and barely being exposed to it.

Where Datalenk stands. Datalenk is published by a French company, keeps its servers and databases in the European Union (Hetzner) and writes nothing to the visitor's device by default. How the default layer works, what waits for the visitor's consent, and what changes if you turn on the optional persistent layer, is on the ↗ page. Like every SaaS we use a few US vendors, for our own operations (CDN, billing, email) and for an optional AI analysis that sends aggregated figures to Anthropic when you click it, all named on our sub-processors page, which is exactly why step 1 is an inventory of every tool and not a single swap.

Step 4: keep historical data portable. Whatever you use today, export your historical data now. A forced switch is the worst moment to discover that years of history cannot leave the tool (the shutdown of Universal Analytics made the same point from a different direction).

Step 5: bookmark the litigation, not the headlines. We keep the Latombe appeal's status, with sources and a dated log, on one page ↗.

FAQ

Is Google Analytics illegal in the EU right now? No. The Data Privacy Framework is in force, and Google is certified under it. The framework is under appeal at the CJEU, but a pending appeal changes nothing about today's legality.

What is Schrems III? A nickname for the anticipated next CJEU ruling on EU-US data transfers. It is currently used loosely to refer to the Latombe appeal (Case C-703/25 P). No such ruling has been issued.

What happened in Latombe v. Commission? French MP Philippe Latombe asked the EU General Court to annul the DPF adequacy decision. On September 3, 2025 the court rejected his challenge and upheld the framework. He appealed to the CJEU on October 31, 2025.

When will the CJEU decide? No date has been announced. We record each procedural step, with its source, on the case page ↗.

Did regulators really declare Google Analytics illegal in 2022? Yes. Following Schrems II, the Austrian DSB (January 2022), French CNIL (February 2022) and Italian Garante (June 2022) each found that a website's Google Analytics transfers violated the GDPR, and ordered sites to stop or fix them. The DPF gave such transfers a legal basis again from July 2023, which is exactly why the DPF's fate matters.

What should I do today? Inventory your US-bound data flows, export your historical analytics data, and evaluate EU-hosted alternatives while there is no deadline pressure. If your analytics tool writes nothing to the visitor's device by default, stores no raw IP and keeps visitor data in the EU with an EU company, the outcome of the appeal has little practical bearing on your analytics stack. Your other tools are another matter, which is why the inventory comes first.