The short answer is that it is not automatically illegal, and it is not automatically fine either. Both of those claims get repeated confidently and neither survives contact with the actual rulings.

This is a summary for people making a decision about a tool, not legal advice.

What the data protection authorities actually decided

Between 2022 and 2023, supervisory authorities in Austria, France, Italy, Denmark, Finland, Norway and Sweden each found specific Google Analytics deployments unlawful. The complaints came from noyb, the privacy organisation founded by Max Schrems, and were filed against many sites at once.

The reasoning was about international transfers, not about analytics. After the Court of Justice struck down the EU-US Privacy Shield in the Schrems II judgment, transfers to the US needed a different legal basis. The authorities found that the standard contractual clauses Google relied on were not sufficient on their own, because they do not stop US intelligence law from reaching the data. The supplementary measures Google had added -- encryption in transit, the option to truncate an IP address -- did not change that, because Google could still read the data itself.

Two details from those decisions get lost in the retelling, and both matter:

  • IP truncation did not save it. The Austrian authority found that the combination of a client identifier with other data still identified the visitor, so removing part of the IP address did not make the data non-personal.
  • They were decisions about particular sites, using particular configurations, at a particular time. They were not a blanket ban on the product.

What the Data Privacy Framework changed

In July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. For a US company that self-certifies under the DPF -- Google does -- transfers can rely on that adequacy decision instead of standard contractual clauses.

This genuinely changes the position the 2022-23 decisions rested on. Those decisions were about the absence of a valid transfer mechanism, and there is now one.

The caveat is that this is the third such framework. Safe Harbour was struck down in 2015, Privacy Shield in 2020, and noyb announced its intention to challenge the DPF on the day it was adopted. A challenge is not an invalidation, and it would be wrong to tell you the framework is about to fall. It is equally wrong to plan as though the question is permanently settled, given that the two previous answers each lasted about five years.

What still has to be true

The transfer question is the one that got the headlines. It is not the only one, and the others are where most GA4 deployments are actually vulnerable.

Consent, properly obtained. Analytics is not strictly necessary, so in the EU it needs consent before anything is stored on or read from the device -- and GA4 stores an identifier. Consent has to be freely given, specific, informed and unambiguous. A banner with only an "Accept" button is none of those. Nor is one that sets the identifier before you click.

Consent Mode configured correctly. Google's Consent Mode changes GA4's behaviour when consent is denied, but it still sends cookieless pings by default and models the gap. Whether the modelled figures are acceptable to you is a measurement question; whether the pings are acceptable is a legal one, and it depends on configuration you have to check rather than assume.

A record you could produce. Under Article 5(2) of the GDPR you have to be able to demonstrate compliance. That means a data protection impact assessment where one is required, a processing record, a retention policy you actually apply, and documented consent.

Everything you added on top. Most GA4 problems in practice are not GA4. They are the User-ID that turned out to be an email hash, the page URL carrying a token or an order id in a query parameter, or the ecommerce payload including a customer name.

What this means for a decision

If you already run GA4 and it is properly consented, properly configured and documented, the adequacy decision gives you a defensible position today. Ripping it out this afternoon on the strength of a 2022 headline is an overreaction.

If you are choosing now, the honest framing is a risk one. Keeping the data in the EU with an EU processor removes the transfer question from your risk register entirely rather than answering it. That is worth something, and how much depends on your sector, your regulator, and how much you want to re-litigate this at the end of the decade.

There is also a plain operational argument that has nothing to do with law: if your analytics needs consent, you are measuring only the visitors who agreed, which is not a random sample of your traffic.

Where Skomi sits

Skomi stores its data in the EU and derives visitor identity on the server from a daily rotating salt, so nothing is written to or read from the visitor's device. There is no transfer to assess and, on the default setting, no consent to collect.

It is also a smaller product than GA4, and the comparison page lists what you give up alongside what you gain -- including the rows GA4 wins, which are real.

Sources worth reading yourself

  • The Austrian DSB decision of December 2021, the first of the series and the most detailed on why IP truncation was insufficient.
  • The CNIL's Google Analytics decisions and its subsequent guidance on exempted audience measurement.
  • The European Commission's adequacy decision for the EU-US Data Privacy Framework, July 2023.
  • The EDPB's recommendations 01/2020 on supplementary measures, which set out the assessment the authorities applied.

Anybody telling you this is simple has not read them.

What Skomi does instead is cookieless by default: nothing is written to the visitor's device, so there is no transfer of an identifier to weigh, and that is what the Analytics product is built on rather than a mode you switch into. The wider field of replacements, ours placed honestly among them, is on Google Analytics alternatives.