As a reminder, since March 2021, all organizations must comply with the requirements of the CNIL within the framework of GDPR standards, particularly with regard to cookies and tracers .
But what does this new decision really mean? Does it mean that Google Analytics is becoming illegal in Europe? What are the consequences for the 84% of websites that use Google Analytics? Will this decision spread and affect all American cloud services?
cnil-illegal-google-analytics-announcement
Google Analytics: Unchallenged Domination
When you are a website manager, Google Analytics appears to be the best tool there is :
Free
Of incomparable functional richness
Particularly effective when it comes to analyzing the behavior of your users and improving your digital assets , whether it is a website, E-commerce, a mobile application or an Extranet
In a context of exploding online sales, Google Analytics is proving to be an essential tool for optimizing your E-commerce performance . With extremely detailed monitoring of a large number of indicators, Google Analytics can identify all the bottlenecks that lower the conversion rate. It is not uncommon, after an Analytics audit and specific recommendations, to succeed in significantly increasing the conversion rates of an E-commerce site.
And, if you also actively run marketing acquisition campaigns via Google Ads, LinkedIn Ads (or other), Google Analytics tracking becomes essential : you precisely measure the effectiveness of your campaigns, you can launch A/B tests and practice incremental improvement of all your marketing levers.
Current competitors
In front of Google Analytics, the alternatives remained limited until now : Matomo , AT Internet are in France the only players with significant market shares. If, for many years, we have encouraged our customers to switch to other software solutions such as these, we often realize that the functional richness of Google (and its ease of implementation / configuration for complex tagging plans) sometimes sweeps away objections related to the GDPR too quickly. And this is all the more so when the latest version of GA: Google Analytics V4 brought the promise of total compliance with the GDPR with the anonymization of IP addresses and the configuration of the data retention period.
What the CNIL decision meansquestion-decision-cnil-google-analytics
After a year and a half of investigation, the CNIL considers that "transfers to the United States are not sufficiently regulated" : despite the possibility of anonymization offered by the Google Analytics botim database tool, the data collected by the Auchan or Sephora site could easily be recombined to individually identify Internet users. The protections put forward by the American giant (in particular V4 of Google Analytics) are insufficient with regard to the GDPR .
This risk of re-identification is directly highlighted by the “Schrems II” ruling. In July 2020, the Court of Justice of the European Union ruled that US law was incompatible with EU law: US authorities (e.g. intelligence services) have the ability to circumvent the GDPR by obtaining personal data of European citizens.
Although this decision only concerns a few websites today, the reasoning proposed by the CNIL will logically apply to any other site operated in France. Any site operated in France may be subject to a CNIL inspection and face a public fine if it does not remove the use of Google Analytics within one month.
The consequences of such a fine are certainly financial but will also impact the direct reputation of brands , which will very quickly be obliged to replace Google Analytics with solutions falling within the scope of the CNIL exemption .
E-BOOK & WEBINAR
Web Analytics for your performance: decipher these analysis tools
Download the e-book
Possible consequences of the CNIL decision: the end of the American cloud?
The CNIL also indicates in its formal notice that “ corrective measures ” could be adopted shortly with regard to other similar tools (in particular all connection tools such as Facebook Connect ).
More broadly, it is to be expected that any American cloud service will no longer be compliant and will be subject to a ban on European territory. Meta's recent threat to shut down its services (Facebook and Instagram) in Europe is the most recent example of this tectonic shift of the technological plates.
And when we talk about any American Cloud service, we must also talk about all the European software solutions that are hosted on American Amazon or Azure servers. All European SaaS players must therefore urgently question their hosting strategy.
