Google Analytics has been banned for use on European websites due to violations of GDPR by Austria's Data Protection Authority.
Google Analytics had also been found not to comply with EU law. The case began when activist Max Schrems and his privacy advocacy group None of Your Business (NOYB) filed a lawsuit with the Information Commissioner's Office.
A landmark ruling by the EU's Court of Justice invalidated in 2020 the US's surveillance of data shared under the Privacy Shield. Recently, Austrian courts ruled that the US surveillance of data shared under the Privacy Shield is illegal.
Google is accused of accessing personal data. In this case, the data was accessed from an Austrian website that used Google Analytics. Based on the information provided, Google could identify the user.
A US law, the American Cloud Act, lets authorities obtain personal information from US providers, even when those providers are based abroad. This means that Google cannot offer an adequate level of protection under Article 44 of the GDPR.
Companies in Europe must remove Google Analytics from their websites or risk being penalized for violating GDPR. European users' data must be hosted in Europe by US providers, or US surveillance laws must be changed.