Google Analytics and EU Privacy Law: The Complete Timeline (2015-2026)

Last updated: June 2026. One entry per consequential event, each with its primary source. Updated whenever a regulator or court moves.

The legal status of Google Analytics in Europe has flipped multiple times in a decade, and each flip followed the same sequence: a transfer framework dies in court, regulators apply the ruling to the most visible US tool on the web, and a migration wave follows. Here is the whole sequence, in order.

2015: The first domino

October 6, 2015: Schrems I. The CJEU invalidates Safe Harbor, the original EU-US data transfer agreement, ruling that US surveillance law (as revealed by Snowden) is incompatible with EU fundamental rights. Thousands of companies, Google included, scramble to Standard Contractual Clauses.

2016-2018: The rebuild

2016. The Privacy Shield framework replaces Safe Harbor. Critics, including its eventual executioner, immediately call it Safe Harbor with a coat of paint.

May 25, 2018. The GDPR becomes applicable. Analytics is now squarely "processing of personal data" wherever identifiers or IPs are involved.

2020: The second domino

July 16, 2020: Schrems II. The CJEU invalidates Privacy Shield, same core reasoning: no effective redress for EU citizens against US surveillance. Crucially, the court adds that SCCs cannot contractually fix US law, which removes the fallback for tools like Google Analytics.

August 2020. Max Schrems' organization noyb files 101 complaints across EU member states against websites using Google Analytics and Facebook Connect, deliberately forcing every national regulator to apply Schrems II to a concrete tool. The complaints are the engine of everything in 2022.

2022: The enforcement wave

January 2022: Austria. The Austrian data protection authority (DSB) rules, on one of the noyb complaints, that a website's use of Google Analytics violated the GDPR: the transfers to Google US lacked a valid basis, and Google's supplementary measures (including IP anonymization settings) were insufficient. The first "Google Analytics is unlawful" decision in the EU.

January 2022: EDPS v. European Parliament. The European Data Protection Supervisor reprimands the European Parliament itself over a website using Google Analytics and a US payment provider. Symbolically perfect: even the EU's own institutions failed the test.

February 10, 2022: France. The CNIL issues formal notices to French websites using Google Analytics: the transfers are unlawful, configuration tweaks do not cure them, migrate or face sanctions. The CNIL publishes guidance effectively saying GA cannot be used lawfully as-is.

June 23, 2022: Italy. The Garante reaches the same conclusion on the same legal logic. Austria, France and Italy now align; Denmark's Datatilsynet follows with equivalent guidance in September.

The market effect. Searches for Google Analytics alternatives explode; EU-hosted analytics vendors report record growth. This is the demand wave the privacy-analytics category was built on.

2023: The fines, then the truce

July 2023: Sweden. The IMY issues the first actual fines for Google Analytics use: approximately 12 million SEK (~$1.1M) against Tele2 and a smaller fine against retailer CDON. The enforcement wave had teeth after all.

July 10, 2023: The truce. The European Commission adopts the adequacy decision for the EU-US Data Privacy Framework (DPF). Transfers to certified US companies, Google included, are lawful again. The 2022 rulings become moot in practice; the migration pressure deflates.

2023-2025: The third challenge forms

September 6, 2023. French MP Philippe Latombe files a direct annulment action against the DPF before the EU General Court (T-553/23) ↗.

September 3, 2025. The General Court upholds the DPF, finding the new US redress mechanism (the Data Protection Review Court) sufficient. First judicial test survived.

October 31, 2025. Latombe appeals to the CJEU (Case C-703/25 P), the court that killed both previous frameworks. noyb separately signals it is considering its own broader challenge.

2026: Where we are now

As of June 2026: the DPF is valid, Google Analytics is lawful to use in the EU under it, the appeal is pending with no hearing date announced, and a decision is realistically expected in 2027-2028 ↗. The pattern above has run twice: framework adopted, framework challenged, framework invalidated, Google Analytics in the crosshairs within months. Whether it runs a third time is now in the CJEU's hands, and we track every procedural step on a dedicated page ↗.

The lesson the timeline teaches

Every organization that migrated calmly did it before a ruling, and every organization that migrated expensively did it after one. The asymmetry is the whole strategic insight: preparing costs little (knowing your transfers, keeping data portable, choosing tools where the question is moot ↗), while reacting costs a fire drill plus years of stranded data. The timeline will get its next entry; the only question is which side of it you are on when it does.

FAQ

Has Google Analytics been fined under GDPR? Yes. Sweden's IMY fined Tele2 ~12M SEK in July 2023 for using it; Austria, France, Italy and others ruled its transfers unlawful in 2022 (orders rather than fines). The rulings were defused by the 2023 Data Privacy Framework.

Is Google Analytics illegal in Europe right now? No. It is lawful under the DPF as of June 2026. The framework is under appeal at the CJEU; the timeline above is why that appeal matters.

What happened to the 101 noyb complaints? They produced the 2022 wave of rulings in Austria, France, Italy and beyond, establishing that configuration tweaks cannot cure unlawful transfers. The reasoning is ready to reactivate if the DPF falls.

What should I watch next? Case C-703/25 P (the Latombe appeal) and any new noyb filing. We maintain a live tracker of both ↗.