On August 17, 2020, the non-governmental organization "None of Your Business" filed 101 identical complaints to the Data Protection Authority (DPA) regarding using Google Analytics by various companies. The complaints focused on whether the transfer of EU personal data to Google in the US via cookies is allowed under the EU General Data Protection Regulation ("GDPR"), following the Court of Justice of the European Union Schrems II. Following these complaints, the French and Austrian DPA ruled that the transfer of EU personal data from the EU to the US through the Google Analytics cookie was illegal.
Google's renewed approach
According to Google Press Release, Google Analytics 4 "is designed with privacy at its core to provide a better experience for both our customers and their users. It helps businesses meet users' evolving needs and expectations with more comprehensive and detailed data collection and use controls. "
The most significant change in terms of EU privacy is that Google Analytics 4 will no longer store the IP address, thus restricting data transfers resulting from the use of Google Analytics controlled in the EU.
Google's previous choice, Universal Analytics, will no longer be available from July 2023. In the meantime, companies are encouraged to switch to Google Analytics 4.