Is Google Analytics allowed in the EU? What regulators have said

By the Privacyboard teamPublished 12 November 20269 min read

Short answer

Yes, as of 12 November 2026 you can use Google Analytics with EU visitors, under two conditions. Its cookies need consent before they are set, and the transfer to Google in the US relies on the EU-US Data Privacy Framework, under which Google LLC is certified. The 2022-2023 bans came before that framework, and a court appeal against it is still pending.

Short answer: yes, as of 12 November 2026, a business can use Google Analytics on a website with visitors in the EU. Two things must be in place: the visitor's consent before Google Analytics sets its cookies, and a lawful transfer of the data to Google in the United States, which today relies on the EU-US Data Privacy Framework. The well-known "Google Analytics is illegal" decisions of 2022 and 2023 were made before that framework existed.

This guide explains what the regulators decided, what changed in July 2023, what is still uncertain, and what to check on your own site. It is general information, not legal advice.

#Why did regulators say Google Analytics was illegal?

The story starts with the Schrems II judgment. On 16 July 2020 the Court of Justice of the EU struck down the Privacy Shield, the framework most US companies used to receive European personal data. From then on, sending data to the US needed another tool, usually Standard Contractual Clauses, plus "supplementary measures" that actually protected the data from US surveillance.

On 17 August 2020 the privacy group noyb filed 101 complaints against European websites that used Google Analytics or Facebook tools. The European Data Protection Board (EDPB) set up a "101 task force" on 2 September 2020 so national authorities could handle them consistently.

The authorities looked at the same questions everywhere:

Is it personal data? Yes. Google Analytics assigns each visitor a unique identifier in a cookie and sees their IP address. Identifiers designed to single people out are personal data, even without a name.
Do Google's protections work? No, said the regulators. Encryption does not help while Google holds the keys, and transparency reports do not stop a government request.
Does IP anonymisation fix it? No. The EDPB task force report notes that anonymising an IP address is "not a suitable measure" when it happens only after the data has reached the third country.

#Which regulators decided what?

When	Authority	What it decided
January 2022	Austria (DSB)	First decision, made public in January 2022: a website's use of Google Analytics transferred data to the US unlawfully, and Google's measures were not effective.
February 2022	France (CNIL)	Formal notice to a website operator: one month to bring its use of Google Analytics in line with the transfer rules, in practice by stopping the tool in its form at the time.
23 June 2022	Italy (Garante)	Reprimand of a website operator, 90 days to comply, and a warning to all Italian sites. It added that a truncated IP address is still personal data.
28 March 2023	EDPB 101 task force	Report of the common positions reached by the authorities on these complaints.
3 July 2023	Sweden (IMY)	Four companies told to stop using the tool. Fines of SEK 12 million for Tele2 and SEK 300,000 for CDON.

All of these decisions share one premise: at the time, the US had no adequacy decision, and the companies relied on Standard Contractual Clauses without measures that worked. None of them said that measuring your audience is unlawful in itself.

#What changed with the EU-US Data Privacy Framework?

On 10 July 2023 the European Commission adopted a new adequacy decision for the United States, the EU-US Data Privacy Framework (DPF). It covers US organisations that certify to the framework with the US Department of Commerce. Transfers to a certified organisation need no further transfer tool.

The CNIL summarised it plainly in its November 2023 guidance on audience measurement: since the decision, transfers to certified US entities "can take place freely". It kept proxy-based pseudonymisation as an option for tools whose provider is not certified, and as good practice.

Google LLC is certified. Its own page on legal frameworks for transfers states that Google LLC "has certified that it adheres to the DPF Principles", for the EU-US framework, the Swiss-US framework and the UK Extension. When we checked the official Data Privacy Framework list on 4 November 2026, Google LLC was shown as active.

So the core problem of 2022 (no valid transfer tool) is solved for now, as long as Google stays certified and the framework stays valid.

#Is the Data Privacy Framework safe for the long term?

It is valid today, but it is being challenged, and you should know the open points:

The Latombe case. A French member of parliament, Philippe Latombe, asked the EU General Court to annul the framework. The court dismissed his action on 3 September 2025 (case T-553/23). He appealed to the Court of Justice on 31 October 2025 (case C-703/25 P). As of 12 November 2026, we found no judgment in that appeal.
The FTC ruling. In June 2026 the US Supreme Court ruled in Trump v. Slaughter that the President can remove members of the Federal Trade Commission at will. The FTC is one of the bodies that enforces the framework's commitments. On 31 July 2026 the EDPB wrote to the European Commission asking it to "closely assess" whether this affects the adequacy decision. The Commission has not suspended or changed the decision.

The previous two frameworks, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice. If the DPF falls too, the 2022 reasoning about Google Analytics would apply again. That is why a fallback plan is sensible, even if you do nothing different today.

Yes. This part never depended on transfers. The ePrivacy Directive (Article 5(3)) requires consent before storing or reading information on a visitor's device, unless it is strictly necessary for the service the visitor asked for. Analytics cookies are not strictly necessary in that sense.

Some regulators allow a narrow exemption for audience measurement. The CNIL, for example, exempts tools whose cookies serve only the site owner, produce anonymous statistics only, are not combined with other processing and do not track people across sites. A tool whose provider reuses the data for its own purposes is outside the exemption unless that reuse can be switched off. The exemption also says nothing about transfers: the CNIL is explicit that it "has no bearing" on them.

In practice, plan for consent: block Google Analytics until the visitor accepts the statistics category, and keep a record of that choice. If you use Google Consent Mode, see our Consent Mode v2 guide for how the signals map to your banner.

#What does Google Analytics 4 do differently?

Google's documentation for EU, Swiss and UK data says that Google Analytics "does not log or store individual IP addresses" from users in those regions. IP addresses are used to derive a coarse location and then discarded, and that lookup happens on servers in the region before data is forwarded. Site owners can also turn off granular location and device data, and Google signals, per region.

These settings reduce what is collected. They do not replace consent, and the page does not say where the forwarded data is processed. Treat them as data minimisation, not as a legal basis.

#Checklist: using Google Analytics with EU visitors

Google Analytics loads only after the visitor accepts the statistics category, including through Google Tag Manager.
Rejecting is as easy as accepting, and the choice can be changed later.
Consent choices are logged with a date and the banner version.
Google is listed as a vendor in your privacy policy and cookie policy, with the purpose, the data and the transfer to the US under the Data Privacy Framework.
Google's data processing terms for Analytics are reviewed and noted in your vendor records.
Granular location and device data and Google signals are reviewed per region and turned off if you do not need them.
Data retention in Analytics is set to the shortest period that serves your reporting.
Google Analytics appears in your record of processing activities.
Someone checks Google's certification on the Data Privacy Framework list from time to time.
You know what you would switch to, or how you would proxy the data, if the framework were struck down.

#What can you do if you want less risk?

You do not have to choose between "Google Analytics as usual" and "no analytics". Common options include:

Keep Google Analytics, minimised. Consent first, granular data and Google signals off where you do not need them, short retention.
A proxy in the EU. A server you control strips the IP address and replaces identifiers before anything reaches Google. The CNIL describes the conditions in its guidance; it notes that this is costly and that changing IP settings alone is not enough.
An EU-hosted or consent-exempt tool. Some audience measurement tools are hosted in the EU or configured to meet a regulator's exemption conditions. Check the regulator's own list or guidance rather than a vendor's claim.

If you use Privacyboard, its cookie banner holds back known trackers such as Google Analytics until the visitor accepts their category, and your vendor records note where each tool processes data.

On 19 November 2025 the European Commission proposed a "Digital Omnibus" that would, among other things, move cookie rules into the GDPR and allow some uses without consent. As of 12 November 2026, it is still being negotiated by the European Parliament and the Council and is not law. Until it is adopted and in force, the current consent rules apply.

#FAQ

#Did any EU country ban Google Analytics?

No country passed a law against it. Several regulators, in Austria, France, Italy and Sweden among others, decided in 2022 and 2023 that specific websites used it unlawfully, because the data went to the US without a valid transfer tool. Those decisions came before the Data Privacy Framework of July 2023.

No tool is compliant on its own; what counts is how you use it. With consent before loading, accurate information to visitors and Google's current certification under the Data Privacy Framework, the main objections of 2022 are addressed. The framework is under legal challenge, so watch for changes.

#Does IP anonymisation make Google Analytics legal?

Not by itself. Regulators said that anonymising an IP address after it reaches the US does not protect it, and the Italian Garante added that a truncated IP is still personal data. Google now says Google Analytics does not log or store individual IP addresses of EU users, which helps, but consent is still needed.

Not in the EU in a standard setup. Its cookies need consent under Article 5(3) of the ePrivacy Directive. Some regulators exempt audience measurement tools that meet strict conditions, so check your regulator's guidance before relying on that.

#What happens if the Data Privacy Framework is struck down?

Transfers to Google would again need Standard Contractual Clauses plus measures that work, which regulators found missing in 2022. You would need to stop, proxy or replace the tool. As of 12 November 2026, the Court of Justice had not ruled on the pending appeal.

#Is the UK any different?

The UK has its own rules and regulator. Google's certification covers the UK Extension to the Data Privacy Framework, and UK law also requires consent for non-essential cookies, with some exceptions. See our UK GDPR guide for the differences.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.