Google Analytics and EU Privacy Law: The Complete Timeline (2015-2026)

Last updated: June 2026. One entry per consequential event, each with its primary source. Updated whenever a regulator or court moves.

The legal status of Google Analytics in Europe has flipped multiple times in a decade, and each flip followed the same sequence: a transfer framework dies in court, regulators apply the ruling to the most visible US tool on the web, and a migration wave follows. Here is the whole sequence, in order.

2015: The first domino

October 6, 2015: Schrems I. The CJEU invalidates Safe Harbor, the original EU-US data transfer agreement, ruling that US surveillance law (as revealed by Snowden) is incompatible with EU fundamental rights. Thousands of companies, Google included, scramble to Standard Contractual Clauses.

2016-2018: The rebuild

2016. The Privacy Shield framework replaces Safe Harbor. Critics, including its eventual executioner, immediately call it Safe Harbor with a coat of paint.

May 25, 2018. The GDPR becomes applicable. Analytics is now squarely "processing of personal data" wherever identifiers or IPs are involved.

2020: The second domino

July 16, 2020: Schrems II. The CJEU invalidates Privacy Shield, same core reasoning: no effective redress for EU citizens against US surveillance. Crucially, the court adds that SCCs cannot contractually fix US law, which removes the fallback for tools like Google Analytics.

August 2020. Max Schrems' organization noyb files 101 complaints across EU member states against websites using Google Analytics and Facebook Connect, deliberately forcing every national regulator to apply Schrems II to a concrete tool. The complaints are the engine of everything in 2022.

2022: The enforcement wave

January 2022: Austria. The Austrian data protection authority (DSB) rules, on one of the noyb complaints, that a website's use of Google Analytics violated the GDPR: the transfers to Google US lacked a valid basis, and Google's supplementary measures (including IP anonymization settings) were insufficient. The first "Google Analytics is unlawful" decision in the EU.

January 2022: EDPS v. European Parliament. The European Data Protection Supervisor reprimands the European Parliament itself over a website using Google Analytics and a US payment provider. Symbolically perfect: even the EU's own institutions failed the test.

February 10, 2022: France. The CNIL issues formal notices to French websites using Google Analytics: the transfers are unlawful, configuration tweaks do not cure them, migrate or face sanctions. The CNIL publishes guidance effectively saying GA cannot be used lawfully as-is.

June 23, 2022: Italy. The Garante reaches the same conclusion on the same legal logic. Austria, France and Italy now align; Denmark's Datatilsynet follows with equivalent guidance in September.

The market effect. Searches for Google Analytics alternatives explode; EU-hosted analytics vendors report record growth. This is the demand wave the privacy-analytics category was built on.

2023: The fines, then the truce

July 2023: Sweden. The IMY issues the first actual fines for Google Analytics use: approximately 12 million SEK (~$1.1M) against Tele2 and a smaller fine against retailer CDON. The enforcement wave had teeth after all.

July 10, 2023: The truce. The European Commission adopts the adequacy decision for the EU-US Data Privacy Framework (DPF). Transfers to certified US companies, Google included, are lawful again. The 2022 decisions are not erased, they were correct on the law as it stood, but the ground under them shifts: transfers of the kind they condemned have a valid basis again going forward, and the migration pressure deflates.

2023-2025: The third challenge forms

September 6, 2023. French MP Philippe Latombe files a direct annulment action against the DPF before the EU General Court (T-553/23) ↗.

September 3, 2025. The General Court upholds the DPF, finding the new US redress mechanism (the Data Protection Review Court) sufficient. First judicial test survived.

October 31, 2025. Latombe appeals to the CJEU (Case C-703/25 P), the court that killed both previous frameworks. noyb separately signals it is considering its own broader challenge.

2026: Where we are now

As of June 2026: the DPF is valid, Google Analytics is lawful to use in the EU under it, the appeal is pending with no hearing date announced, and a decision is realistically expected in 2027-2028 ↗. The pattern above has run twice: framework adopted, framework challenged, framework invalidated, Google Analytics in the crosshairs within months. Whether it runs a third time is now in the CJEU's hands, and we track every procedural step on a dedicated page ↗.

The lesson the timeline teaches

Every organization that migrated calmly did it before a ruling, and every organization that migrated expensively did it after one. The asymmetry is the whole strategic insight: preparing costs little (knowing your transfers, keeping data portable, choosing tools that give you the smallest possible stake in the next ruling ↗), while reacting costs a fire drill plus years of stranded data. The timeline will get its next entry; the only question is which side of it you are on when it does.

Read the decisions again and one detail jumps out: every order in 2022 landed on a website, not on Google. The tool was the subject of the analysis; the site owner was the one who had to act. That is the part worth internalizing before the next entry, because it will work the same way.

How Datalenk actually works, so you can hold us to it. Datalenk is cookieless by default: the standard snippet writes nothing to the visitor's device, no cookie and no localStorage, and no raw IP is ever stored (it is used in memory to derive a coarse location, then discarded). Uniqueness within a day comes from a server-side hash of the site, the IP and the user agent, salted with a secret that rotates every 24 hours, which is what makes following the same person from one day to the next impossible, for us too. Customers can explicitly opt into a Persistent layer that stores a pseudonymous first-party identifier for 90 days, which brings the consent question back: our dashboard makes them tick a box that says so before it turns on. We run that layer on datalenk.com ourselves, and we disclose it in our own privacy policy. Visitor data stays on EU infrastructure and never leaves it.

FAQ

Has anyone been fined over Google Analytics? Yes, but the fines landed on the websites using it, not on Google. Sweden's IMY fined Tele2 approximately 12M SEK in July 2023, and retailer CDON a smaller amount, for their own use of the tool. The 2022 decisions in Austria, France and Italy worked the same way: they were orders against site operators, not sanctions against Google. The pressure eased when the 2023 Data Privacy Framework restored a legal basis for the transfers going forward, which is precisely why the appeal against that framework matters.

Is Google Analytics illegal in Europe right now? No. It is lawful under the DPF as of June 2026. The framework is under appeal at the CJEU; the timeline above is why that appeal matters.

What happened to the 101 noyb complaints? They produced the 2022 wave of rulings in Austria, France, Italy and beyond, establishing that configuration tweaks cannot cure unlawful transfers. The reasoning is ready to reactivate if the DPF falls.

What should I watch next? Case C-703/25 P (the Latombe appeal) and any new noyb filing. We maintain a live tracker of both ↗.