Google Analytics always processes all data in the USA, Google admits

It's official: Google admits that all data collected by Google Analytics is also processed in the USA. Proceedings against Google are now pending. Will data protection finally prevail over greed for profit?

Google Analytics is the best-known and probably most powerful, but also most likely the most privacy-hostile tool for spying on user behavior. There are now numerous privacy-friendly alternatives to Google tools for websites. I claim that most website operators do not need to use any Google tools on their websites. Here is a selection of the tools for which good alternatives exist: Google Analytics, Google Fonts, Google reCAPTCHA, Google Tag Manager, Google Maps. Many of these alternatives are available free of charge on Dr. DSGVO.

Since the CJEU judgment of 16 July 2020 (Case C-311/18), it is established that the Privacy Shield was always invalid. The Privacy Shield was an informal data protection agreement between Europe and the USA. The shield was meant to guarantee EU citizens that data protection rights equivalent to those in Europe are respected in the USA.

The Privacy Shield was declared invalid because the USA has numerous laws that are hostile to data protection. For example, the Cloud Act allows American authorities, by order of the American president, to force American companies to hand over data of European customers. This does happen, by the way, as a statistic from Google shows.

The privacy organization noyb has now filed a complaint against Google. Beforehand, Google had to answer some uncomfortable questions from the Austrian data protection authority. In doing so, Google either tried to talk its way out of it or let something slip.

Google directly admits (quoting the official German translation of the English original available to me):

The passage marked with "[…]" contains nothing but the text "See our response to question #2".

The English original reads:

What exactly does this mean?

Google's statements necessarily and objectively lead to several explosive conclusions:

Google potentially processes data worldwide

This applies at least to Google Analytics. Google's statement says: "The Google Analytics pixel-request (including all the information sent with that request […]) will be first routed to the closest collector in the system and may then be transferred onward for storage and processing." 

To collect data means Erheben von Daten in German. Compare the English and German texts of the GDPR.

Specifically, this means:

• Google Analytics often collects data in geographic proximity to a user
• This data is then sent to the USA, either directly or indirectly
• Data processing takes place in the USA, namely at least data collection, data storage and further processing

Data collection is the earliest possible data processing activity, as can be seen from Art. 4 No. 2 GDPR, the title of Art. 13 GDPR and my analysis of the concept of data collection.

Data collection is already the factually possible taking note of personal data that is to be processed automatically and that arrived on the basis of an offer. In this case, the offer is every website visited that embeds Google Analytics.

Google always processes data in the USA

This definitely applies, and is now (until further notice) undisputed, for Google Analytics, because Google itself claims so. Every use of Google Analytics is therefore a violation of Art. 44 GDPR unless consent has been obtained. This also applies to the cookieless variant of Google Analytics.

Consent as a legal basis is permissible under Art. 6(1)(a) GDPR. However, it must satisfy numerous requirements. I assume that no one will succeed in untangling Google's extreme lack of transparency in data processing to the point where a clean consent request (so-called user consent) can be obtained.

In any case, Google itself admits that website operators enter into standard contractual clauses with Google LLC (USA). Google also admits that Google LLC is a processor for Google Ireland. The USA is, as is well known, not the best place for personal data.

Anyone who obtains consent for Google Analytics had better explain exactly what happens to the data at Google and who the data recipients are. See, for example, Art. 13 GDPR, which defines the controller's information obligations. Otherwise things will get very tight in court, if one even seriously tries to refute a warning letter received.

Further consequences

If a website operator exposes user data to the risk of unauthorized access, this is a breach of confidentiality under Art. 32(1)(b) GDPR. User data already includes the users' network addresses, which are necessarily transferred to Google when a website embeds Google Analytics.

Potentially, any Google tool, such as Google reCAPTCHA or Google Fonts, could always beam data to the USA. I bet Google will admit this at some point.

All website operators who still use Google tools without consent should take a hard look at themselves and stop this as quickly as possible.

Anyone who wants to do it properly should ideally stop using Google tools on websites altogether. Strangely enough, I manage to do this on numerous websites that offer quite a lot functionally. I simply do not need Google's tools on my websites.

Surely only a few German websites (in percentage terms) are so relevant that they want to accept considerable legal risks for economic reasons. Anyone who earns money with their website mainly because Google and other internet corporations support illegal business practices has certainly not earned my sympathy when they soon have to look for a new occupation.

Here are a few suggestions for data protection on websites:

• External Google Fonts: Replace with locally hosted Google fonts
• Google Maps: Remove it, because it is useless. If it should exceptionally be useful after all: use my privacy-friendly map
• Google reCAPTCHA: use another solution or leave it out (was the tool only built in because everyone does it?)
• Google Analytics: Use Matomo or Trackboxx, or leave out the analytics tool entirely (how often do you look at the analytics data? What do you do with it then?)

Plenty of information on privacy-friendly alternatives can be found on Dr. DSGVO.

For especially advanced people and companies, here is a pro tip: Under no circumstances use one of the better-known consent tools, because it will make your website even more wrong. Proof: See my numerous analyses, including the objective weaknesses of so-called cookie solutions.

Background

The USA has at least three legal provisions that empower American authorities to access data of European citizens when it is in the hands of American companies. American companies can thus choose whether to violate national laws or the GDPR. I suspect they would rather violate the GDPR.

Due to the complexity, I can only address the legal situation in excerpts here, and I mark my following statements as preliminary and not reliable.

Cloud Act

Cloud Act is an abbreviation and stands for Clarifying Lawful Overseas Use of Data Act. As this name indicates, it is about surveillance abroad. The Cloud Act allows access to information stored outside the USA. However, data within the USA is not better protected as a result, but can be accessed by means of an investigation order.

The statement of the European Data Protection Board (EDPB) on the Cloud Act shows how explosive it is considered to be. Quote: "The US CLOUD Act therefore entails the possibility that such electronic communication or remote computer service providers are compelled to answer a request by US law
enforcement authorities for the disclosure of personal data that are subject to the
provisions of the GDPR."

The legal text can be accessed here:

The CJEU did not comment on the Cloud Act in the Schrems II judgment, because the Cloud Act has only existed since 2018 and the lawsuit predates that.

US Executive Order 12333 (EO 12333)

This is a presidential order that expanded the powers of the American intelligence agencies. According to Wikipedia, the NSA regards it as the legal basis for the global surveillance of mobile phones. It is also used to justify the surveillance of data centers of American internet companies such as Google.

Title 50 United States Code (U.S.C.) § 1881a (FISA 702)

Better known by the abbreviation FISA. FISA stands for Foreign Intelligence Surveillance Act.

The law justifies surveillance abroad and counterintelligence measures by the USA.

As the CJEU found in its judgment (Schrems II), neither FISA nor EO 12333 meets the requirements of the GDPR.

Further explanations on this and on other American laws and legal provisions that cause data protection problems have been prepared by the Scientific Services of the German Bundestag.

The NSA has the ability to intercept data flowing into the USA already in the Atlantic via the undersea cable. This is called upstream collection and is part of the PRISM program, which was exposed by Edward Snowden. According to Wikipedia, data in the data stream entering the USA can be intercepted on the basis of the above-mentioned authorizations FISA and EO 12333.

The US legal instruments mentioned also pose the problem that EU citizens are not entitled to their rights under the GDPR.