Denmark has become the latest European country to find that the use of Google Analytics for web analytics purposes is unlawful, following similar conclusions made by other data protection watchdogs in Austria, France, and Italy.
In a Sept. 21 judgment, the Danish Data Protection Authority (Datatilsynet) became the latest data protection watchdog in the EU to conclude that the use of Google Analytics violates the EU’s General Data Protection Regulation (GDPR), because it enables companies to transfer user data outside the EU without necessary legal protections.
The GDPR is designed to protect the privacy of European citizens, which means, among other things, “that you should be able to visit a website without your data ending up in the wrong hands,” Makar Juhl Holst, senior legal advisor at the Danish DPA, stated in a press release. “We have carefully reviewed the possible settings of Google Analytics and have come to the conclusion that you cannot use the tool in its current form without implementing supplementary measures.”
Growing List of Countries
The decision by the Danish DPA follows a series of similar judgments made this year by other European authorities. The Austrian DPA issued its first decision regarding the unlawful use of Google Analytics in January 2022, followed by a similar conclusion made by the French DPA in February. In June 2022, the Italian DPA also issued a finding that the use of Google Analytics under the given circumstances was unlawful.
All the cases resulted from complaints filed by the non-profit group, None of Your Business (NOYB), following the judgment of the Court of Justice of the European Union in the Schrems II judgment. As alleged by NOYB, the central issue raised in all the cases is that the transfer of personal data of website visitors to Google in the United States are—in certain cases— not guaranteed a level of protection that is essentially equivalent to that within the EU.
“The fact that the cases convey a pan-European position among the supervisory authorities also means that, in a specific case with similar circumstances, the Danish DPA will reach the same result as our European colleagues,” the Danish DPA stated.
The data protection watchdog further signaled that its decision has broad implications for Danish companies. Danish companies that use Google Analytics must assess whether continued use of the tool complies with data protection law. In practical terms, this means bringing the overall level of data protection to a level that is equivalent to that of the EU, the Danish DPA stated.
Companies must either bring their use of Google Analytics for web analytics into compliance by implementing certain technical, contractual, and organizational supplementary measures, or, if necessary, discontinue using the tool, the agency stated.
One potential technical solution for using Google Analytics, for example, may be to implement pseudonymization, whereby the data cannot be linked back to a data subject. The Danish DPA specifically cited published guidance issued in July by the French DPA explaining how to implement pseudonymization through the use of a “reverse proxy server.”
The Danish DPA stated that its guidance is based on information provided by the European supervisory authorities’ decisions and the Danish DPA’s own research and, thus, “there may be circumstances or technical settings which the Danish DPA has not taken into account,” the agency stated. Companies and individuals are encouraged to reach out to the Danish DPA if they believe there are circumstances that the guidance does not take into account.
For further guidance, the Danish DPA has published questions and answers regarding potential solutions that have been raised and what its stance is on these solutions. 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.