1. SEJ
  2.  ⋅ 
  3. Tools

Google Analytics Violates GDPR, Says Swedish Watchdog

Google Analytics is under scrutiny for GDPR issues. Swedish data protection authority warns companies against use.

  • Swedish regulators fined companies for using Google Analytics.
  • Regulators say Google Analytics violates GDPR by transferring data to the U.S. without consent.
  • Google issued a response in defense of its Analytics tool.

The Swedish Authority for Privacy Protection (IMY) has cautioned companies against using Google Analytics due to surveillance risks posed by the U.S. government.

The warning comes amid growing concerns over the legality of transferring Europeans’ data to the U.S. under laws like the General Data Protection Regulation (GDPR).

The GDPR & Data Transfer Concerns

GDPR requires strict privacy protections and consent for handling individuals’ personal information.

Google Analytics has been found to violate this by transferring data from websites and mobile apps to the U.S., where privacy laws are weaker, and intelligence agencies can access the information.

The 2020 Schrems II ruling by Europe’s top court invalidated the Privacy Shield data transfer pact and put these transfers under scrutiny.

IMY Investigation Puts Spotlight On Google Analytics

IMY investigated four Swedish companies—CDON, Coop, Dagens Industri, and Tele2—following a complaint by privacy group NOYB that they were illegally using Analytics.

IMY audits revealed violations of GDPR’s consent and data transfer requirements. The agency fined CDON $30,000 and Tele2 $1.1 million and ordered all but Dagens Industri to stop using Analytics.

Experts say the penalties, though small, set an important precedent.

Tele2 and CDON plan to appeal, arguing the fines are disproportionate, but said they would comply with the orders.

E.U. & U.S. Struggle To Forge New Data Transfer Deal

The E.U. and U.S. policymakers are negotiating a new data transfer pact to replace Privacy Shield. But critics argue it won’t prevent U.S. snooping or empower Europeans in U.S. courts.

IMY’s decision follows similar scrutiny of Meta’s data practices, which recently drew a $1.3 billion E.U. fine.

Regulators worldwide are ramping up enforcing laws like GDPR, China’s Personal Information Protection Law, and Brazil’s Data Protection Law. While some aim to check big tech’s power, rules often differ—creating hurdles for global companies.

These decisions affect these four companies and have implications for all organizations that fail to comply with GDPR.

For Google and others, changes may be needed to analytics and ad models that have long depended on freely moving personal data worldwide.

As data privacy goes global, that era could be coming to an end.

Google’s Response

In a statement to TechCrunch regarding IMY’s decisions, Google emphasizes that Google Analytics doesn’t identify or track specific individuals across the web.

The company says website publishers are responsible for compliance and ethical data use. Google does its part by providing safeguards, controls, and resources.

Google says:

“People want the websites they visit to be well designed, easy to use, and respectful of their privacy. Google Analytics helps publishers understand how well their sites and apps are working for their visitors — but not by identifying individuals or tracking them across the web. These organizations, not Google, control what data is collected with these tools, and how it is used.”

Featured Image: sdx15/Shutterstock

Category News Tools
SEJ STAFF Matt G. Southern Senior News Writer at Search Engine Journal

Matt G. Southern, Senior News Writer, has been with Search Engine Journal since 2013. With a bachelor’s degree in communications, ...

Google Analytics Violates GDPR, Says Swedish Watchdog

Subscribe To Our Newsletter.

Conquer your day with daily search marketing news.