European data protection authorities have been issuing decisions involving specific uses of Google Analytics for years. If you run a website in the EU, this article explains the documented regulatory landscape and what a privacy-first alternative looks like in practice.

Quick answer

European DPAs have issued decisions against specific uses of Google Analytics involving EU-US data transfers and identifiers used for analytics. GA4 may be configurable in different ways, and the EU-US Data Privacy Framework changed the transfer landscape, but many European teams still prefer privacy-first analytics tools that avoid tracking cookies, cross-site tracking, fingerprinting, and non-EU infrastructure. Whether your specific site's use of Google Analytics is lawful depends on your configuration, your DPA's guidance, and your legal basis — this article cannot make that determination for you.

Key takeaways

European DPAs have issued decisions against specific uses of Google Analytics involving EU-US data transfers.
GA4 commonly introduces cookie-consent and transfer-compliance complexity for EU sites.
Privacy-first analytics tools reduce that complexity by avoiding tracking cookies, cross-site tracking, and fingerprinting.
Atriqo does not make your whole site compliant; it reduces the analytics-specific friction points.

Definitions

Privacy-first analytics: web analytics designed to avoid tracking cookies, cross-site tracking, and fingerprinting. Session identification relies on server-side mechanisms rather than persistent browser identifiers.

GDPR-native by design: product positioning meaning the tool is designed around EU data protection principles from the ground up, rather than retrofitted with mitigations. It is not a compliance certification.

The short answer: it depends on your configuration, your legal basis for transfers, and which authority has jurisdiction — but the documented regulatory trend in Europe has been consistently unfavorable toward common deployment patterns.

Multiple national data protection authorities (DPAs) have issued formal decisions or guidelines finding that specific uses of Google Analytics involve unlawful data transfers:

Austria (DSB): On 13 January 2022, the Austrian DPA issued a decision finding that the use of Google Analytics on an Austrian website violated GDPR Article 44, because user data (including IP addresses and browser identifiers) was transferred to Google in the United States without adequate safeguards under the then-invalidated Privacy Shield. (noyb.eu)
France (CNIL): On 10 February 2022, the French DPA issued a formal notice (mise en demeure) requiring a French website to comply with GDPR, finding that transfers of data to Google's US servers were unlawful under the circumstances reviewed. (cnil.fr)
Italy (Garante): On 9 June 2022, the Italian DPA (Garante) issued a similar decision against an Italian website (Caffeina Media) using Google Analytics, citing the same EU-US data transfer concerns. (garanteprivacy.it)
Germany (various Laender DPAs): German data protection authorities have issued guidance indicating that Google Analytics as typically deployed is incompatible with GDPR unless specific and technically complex mitigations are in place — IP anonymization alone is not considered sufficient per German guidance. (summary: Hunton Privacy Blog)

The Austrian, French, and Italian actions are formal administrative decisions involving specific uses of Google Analytics; the German position is published regulatory guidance from the Laender data protection authorities rather than a single case decision. Either way, they are documented in the public record, not casual opinions. A note on timeline: these 2022 decisions concerned the Universal Analytics era — the version of Google Analytics deployed at the time — not GA4. GA4's later changes to IP handling were, in part, Google's response to exactly these concerns; but the underlying EU-US data transfer question the decisions raised persists. The EU-US Data Privacy Framework (DPF), the Commission adequacy decision that went into effect in July 2023, provides a new legal mechanism for EU-US data transfers that was not available at the time of those decisions. (Commission Implementing Decision (EU) 2023/1795)

This article does not provide legal advice. Whether your specific use of Google Analytics is lawful in your jurisdiction depends on your configuration, your DPA, and the ongoing legal landscape. What the public record shows is a documented regulatory concern that many EU site owners are choosing to address proactively.

Understanding the documented technical reasons these concerns arise helps you evaluate alternatives more clearly.

Cookies and persistent identifiers. GA4 sets first-party cookies (_ga, _ga_*) by default to identify returning visitors across sessions. (Google developer docs) Under ePrivacy regulations, placing non-essential cookies requires prior user consent in most EU jurisdictions. That means a consent banner, and all the conversion-rate cost that comes with it.

Data transfers to the US. GA4 is operated by Google LLC (US), with Google Ireland Ltd acting as the EU entity. Data collected in the EU flows to Google's US infrastructure. The legal basis for this transfer — and whether it satisfies GDPR Article 44 — is exactly what European DPAs have been examining.

Controller relationship complexity. When you use GA4, Google processes data under a Data Processing Agreement — but depending on your account's data-sharing settings (for example "Google products & services", or enabling Google Signals / ads linking), Google may also use that data for its own purposes, such as improving Google's products or ads personalization. (Google: data-sharing settings) Where those settings are enabled, the controller-processor relationship becomes more complex than a pure data-processor arrangement, and European DPAs have noted this in their decisions.

Consent Mode. Google's Consent Mode is designed to mitigate the consent problem, but it adds implementation complexity and does not eliminate the underlying EU-US data transfer question.

What does a privacy-first alternative look like?

Atriqo is a privacy-first, cookieless web analytics tool, hosted in the EU (Germany), built as a GDPR-native-by-design alternative to Google Analytics.

A tool built around EU data protection principles from the start looks different from GA4 with mitigations layered on top.

The key differences in technical architecture:

No cookies. A cookieless analytics tool identifies sessions using a server-side mechanism — typically a hash of the IP address, user agent, and a rotating daily salt — without setting any cookie on the visitor's browser.

Because Atriqo's tracker does not set analytics cookies, it does not add the common cookie-consent trigger that GA4 introduces. Your site may still need a banner if other tools, embeds, pixels, or vendors require consent.

IP discarded after a privacy hash is computed. The raw IP address is never stored. It is used to compute a hash (using HMAC with a secret key and a rotating daily salt), then discarded. The hash changes daily, so the same visitor tomorrow produces a different hash. This is pseudonymous, not anonymous — the daily hash still functions as a session identifier — but the original IP is gone.

EU-hosted infrastructure. Data stays in the EU from collection to storage. For a site owner concerned about GDPR Article 44 data transfer rules, choosing a tool where the EU-US transfer question does not arise is a meaningful architectural difference.

No cross-site tracking. Each website is a separate analytics silo. There is no mechanism to track a visitor across different sites, because each site's data is keyed to that site's identifier only.

GA4 vs. a privacy-first alternative: a direct comparison

The table below compares GA4 with Atriqo on the dimensions that matter most for EU GDPR concerns.

Feature comparison
Dimension	GA4	Atriqo
Cookies set by default	Yes — `_ga`, `_ga_*` first-party cookies (Google docs)	No — session identified via server-side HMAC hash (Atriqo methodology)
Consent banner typically required (EU)	Yes — non-essential cookies require prior consent under ePrivacy in most EU jurisdictions (ePrivacy Directive 2002/58/EC, Art. 5(3))	Not required for Atriqo's tracker (no analytics cookies set). If your site uses other tools, your consent obligations depend on your full vendor stack. (Atriqo methodology)
Data hosting	Mixed — Google operates EU data centers; US parent (Alphabet) with Google Ireland as EU entity; EU-US transfers under SCCs / EU-US DPF (EU-US DPF adequacy decision)	EU — analytics infrastructure hosted in Germany (Hetzner Falkenstein)
IP address handling	Used by Google for geolocation at collection; per Google, IPs are not logged for EU traffic, but transient processing does not remove the EU-US transfer question (Google GA4 data & privacy)	Discarded after a privacy hash (HMAC) is computed; never stored (Atriqo methodology)
Cross-site tracking	Limited (GA4 uses first-party cookies; the broader Google ad ecosystem uses cross-site identifiers) (Google docs)	No — each site is a separate data silo (Atriqo methodology)
Fingerprinting	Not a primary GA4 mechanism (cookies preferred)	No fingerprinting (Atriqo methodology)
EU jurisdiction (entity)	No — US parent Alphabet, Google Ireland Ltd as the EU entity	Yes — Spain-registered entity
EU-US data transfer documented concern (GDPR Art. 44)	Present — documented in Austrian, French, and Italian DPA decisions plus German regulatory guidance (2022) (noyb.eu)	Not present — data stays in EU
Free tier	Yes (standard GA4 free tier — with reporting thresholds and sampling above quota limits) (GA4: about data sampling)	Yes — 10,000 billable events/month, no credit card, no expiry
Paid entry tier	GA360 (Analytics 360) — custom enterprise pricing, no public flat rate (Google Marketing Platform)	Free up to 10k billable events/month (no credit card, no expiry); paid plans from €4/month for 100k billable events

Facts vs interpretation

The table above contains two types of information worth distinguishing:

Documented facts: The Austrian DSB, French CNIL, and Italian Garante decisions — and the German Laender DPA guidance — are public record. The EU-US DPF went into effect in July 2023. GA4 sets _ga and _ga_* cookies by default. These are verifiable facts about specific decisions and technical defaults.

Our interpretation: That these facts constitute a reason to consider switching tools is Atriqo's commercial position. A lawyer advising your organization might reach a different conclusion about your specific risk profile, your jurisdiction, and whether your existing Google Analytics configuration mitigates the documented concerns sufficiently.

"But I've been using GA4 for years with no problem"

This is a common reaction, and it is fair. Regulatory enforcement is not uniform. DPA resources are limited; active investigations target specific complainants and high-profile cases more than they perform blanket audits.

What the documented record tells us is the direction of travel: DPAs in Austria, France, and Italy have issued decisions — and the German authorities published guidance — finding that specific uses of Google Analytics involving EU-US transfers raise documented regulatory concerns.

The EU-US Data Privacy Framework has created a new transfer mechanism since 2023, and on 3 September 2025 the General Court of the EU dismissed a challenge to its validity (Case T-553/23, Latombe v Commission), upholding the Commission's adequacy decision. (curia.europa.eu) That ruling has since been appealed: on 31 October 2025 Philippe Latombe brought an appeal before the Court of Justice (Case C-703/25 P), so the adequacy decision's validity remains under review at the EU's highest court. (EUR-Lex, OJ C/2025/6610) The long-term stability of EU-US transfer frameworks therefore remains debated, and site owners still need to understand what data their analytics stack sends, where, and under which mechanism.

The practical risk question is one you and your legal counsel need to answer for your specific situation. The factual answer to "is there documented regulatory concern about specific uses of Google Analytics?" is yes.

"GDPR-native by design" is a positioning claim, not a compliance certification. It means the tool was built from the ground up to align with EU data protection principles, rather than retrofitted with mitigations.

For Atriqo specifically, "GDPR-native by design" means:

No cookies are set by the tracker.
No fingerprinting of visitors.
IP addresses are discarded after a privacy hash is computed (HMAC with a rotating daily salt). The raw IP is never written to disk.
No cross-site tracking — each site's data is siloed.
Analytics infrastructure hosted in the EU, with infrastructure specifically in Germany (Hetzner Falkenstein).

This does not mean Atriqo makes your site GDPR-compliant. Your site's compliance depends on your full vendor stack, your processing activities, and your DPA guidance. What it means is that the analytics tool itself is not the source of the common GDPR friction points.

What about the analytics data quality trade-off?

Cookieless analytics works differently from cookie-based analytics. It is worth being honest about this.

What works well: pageview counts, unique visitor estimates within a day, session metrics, top pages, referrers, geographic distribution (country-level), device and browser breakdown, UTM campaign tracking, custom events within a session, real-time active visitors, conversion goals within the same session.

What is less precise: returning visitor identification across days (the hash rotates daily, so the same physical visitor tomorrow has a different hash), multi-session journey analysis, long-term cohort retention, revenue attribution for purchases that span multiple sessions.

This is a deliberate trade-off. If your primary use case is aggregate traffic analysis, campaign performance, and understanding which pages and sources drive visits, cookieless analytics is accurate enough. If you need precise individual user tracking across weeks or months, that requires persistent identifiers — which means cookies — and that is a different product for a different use case.

Is Atriqo right for you?

Atriqo is built for:

Developers and marketers at European businesses who want clean traffic data without the GDPR overhead of cookie consent banners introduced by analytics tools.
Sites that primarily need aggregate metrics (traffic, sources, conversions) rather than individual user tracking.
Teams that want a simple, fast dashboard without the complexity of GA4.
Anyone migrating away from Google Analytics because their DPA has raised concerns or because they want to reduce that risk proactively.

Atriqo is not the right fit for:

Product teams needing session replay, heatmaps, or A/B testing (that is a different category of tool).
Sites that need precise multi-day individual user journeys (cookieless tracking has real limits here).
Large enterprise analytics requiring custom data warehousing or complex attribution modeling.

What this article cannot tell you

This article cannot determine whether your specific website is lawful. It cannot review your full vendor stack, contracts, legal basis, consent implementation, retention settings, or DPA guidance. It can explain the documented regulatory concerns and the technical differences between Google Analytics and a privacy-first analytics architecture. If you have specific compliance questions for your site, consult a qualified legal professional familiar with EU data protection law.

Getting started

Atriqo is currently in development. The free tier — 10,000 billable events per month (a billable event is any tracked event: pageview, outbound click, file download, 404, or custom event), no credit card required, no expiry — will be available at launch.

If you want early access, join the waitlist. You will hear from us when the product is ready.

Join the waitlist

This article describes factual documented decisions by European data protection authorities and the technical architecture of Atriqo. It does not constitute legal advice. For specific compliance guidance, consult a qualified legal professional familiar with EU data protection law.

Google Analytics and GDPR: EU Risks, DPA Decisions, and Alternatives