{"id":1916,"date":"2022-02-15T15:02:16","date_gmt":"2022-02-15T22:02:16","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=1916"},"modified":"2022-02-15T15:10:15","modified_gmt":"2022-02-15T22:10:15","slug":"google-analytics-declared-illegal-in-france","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/02\/15\/google-analytics-declared-illegal-in-france\/","title":{"rendered":"Google Analytics Declared Illegal in France"},"content":{"rendered":"\n

What Happened?<\/h3>\n\n\n\n

On Thursday, February 10th, the Commission nationale de l’informatique et des libert\u00e9s (CNIL<\/a>) of France, declared that using Google Analytics is in violation of the European Union’s General Data Protection Regulation (GDPR). This came about after the non-profit privacy advocacy organisation, None Of Your Business (NOYB<\/a>) brought up privacy concerns of using this service to CNIL (yes, that is what they are called). CNIL then confronted certain websites using Google Analytics, and ordered them to stop.<\/p>\n\n\n\n

What is Google Analytics?<\/h3>\n\n\n\n
\"\"
Google Analytics Dashboard<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Google Analytics is a tool that website owners can use, that tracks and reports website traffic. In this case, data about website traffic is transferred from France to the USA via transatlantic communication cables. The data is then processed on American servers before being sent back to French website owners. This data collection is legal without consent in France, so long as the analysis is done anonymously. <\/p>\n\n\n\n

What’s the issue?<\/h3>\n\n\n\n

The issue (according to CNIL) is that Google has not taken the appropriate security measures in order to ensure that American intelligence services (for example the CIA, FBI) cannot access the personal data of French citizens during the transfers. Either CNIL cannot trust American intelligence services to simply mind their own business, or American intelligence services were never interested in minding their own business in the first place.<\/p>\n\n\n\n

What does this mean?<\/h3>\n\n\n\n
\"\"
Transatlantic Communication Cables<\/figcaption><\/figure>\n\n\n\n

Heavy restrictions on how personal data is transferred from the EU to the USA makes it harder for companies such as Google or Meta to provide their services in the EU, since they rely heavily on analyzing user data.<\/p>\n\n\n\n

As evidence, Meta announced in a recent annual report that\u00a0 <\/p>\n\n\n\n

“If a new transatlantic data transfer framework is not adopted and we are unable to continue to rely on SCCs (standard contractual clauses) or rely upon other alternative means of data transfers from Europe to the United States, we will likely be unable to offer a number of our most significant products and services, including Facebook and Instagram, in Europe.”<\/p>[1] Meta Annual Report<\/cite><\/blockquote>\n\n\n\n

So far Google has not made any comment on the recent CNIL decision, but has claimed in the past that organizations using Google Analytics have control over the data they collect.<\/p>\n\n\n\n

What’s next?<\/h3>\n\n\n\n

CNIL gave this particular website owner one month to stop using Google Analytics. After that they are still allowed to use a different traffic monitoring tool, so long as it does not involve the transfer of personal data outside of the EU. In the future, Google might be forced to beef up their security if they want to keep the business of European users, since France is not the only country to have made this decision. About a month ago, Austria made a similar decision about Google Analytics. And with the current climate of internet privacy in Europe compared to North America, it would not be surprising if more European countries followed suit. It will be interesting to see the result of this shift towards privacy, as nations continue to attempt to strike a balance between the privacy of their citizens and the wishes of big tech companies.<\/p>\n\n\n\n

References<\/h4>\n\n\n\n