In early February, France’s information watchdog (formally known as commission Nationale de l’informatique et des libertés, or CNIL) concluded that Google Analytics’ data collection and transfer policies violate the European Union’s General Data Protection Regulation (GDPR) law.
The official decision echoes the Schrems II decision in 2020 by the Court of Justice of the European Union (CJEU). In the Schrems II case, Austrian activist and lawyer Max Schrems argued that Google had inadequate protections in place for data transferred out of the EU.
Let’s look at the factors driving the global conversation and how they will impact marketing in 2022.
The CNIL decision, Schrems II, and a handful of other legal initiatives that are currently exploring litigation all centrally focus on the GDPR — Europe’s sweeping data protection and privacy legislation. The law, adopted in 2016 and enforceable since 2018, covers data protection and privacy within the EU and the European Economic Area (EEA).
Considered among the world’s strongest data protection laws, GDPR protects consumer data, restricting what kinds of data companies can access and what they can do with it.
Before 2020, the technical framework for data transfer to the U.S., known as Privacy Shield, served as a safeguard between the EU and the U.S. But, in 2020, Schrems and his legal team pointed out that, even with Privacy Shield, U.S. federal surveillance practices theoretically allow the government access to protected data. Schrems argued this access violates GDPR policy, and the CJEU agreed.
This February, the CNIL issued its own press release, taking a similar position as the CJEU. While EU standards on surveillance are clear and restrictive, once the data is transferred to the U.S. via Google Analytics, it is technically accessible to U.S. intelligence services. Therefore, the organization concluded that Google Analytics poses “a risk for French website users who use this service and whose data is exported.”
In its statement, the CNIL ordered an unnamed website operator to comply with the GDPR within 30 days, “if necessary by ceasing to use the Google Analytics functionality.”
Privacy continues to dominate news cycles and is becoming a top priority for consumers across the globe. As decisions like the CNIL’s and Schrems II shape privacy, they also impact marketing strategies, especially those that have relied heavily on Google Analytics and third-party data.
The good news is that first-party and zero-party data are stepping in to fill the gap. As cookies disappear, fully customized experiences will become part and parcel of the consumer-brand relationship. This kicks critical user-level data back to brands and helps drive better experiences for users. These factors will drive decision-making for content production, advertising initiatives, and performance marketing.
What’s more, governing bodies and tech companies like Alphabet and Meta continue to work toward amicable solutions that will meet privacy standards for all.
As of this writing, there is not yet a solution to replace the original Privacy Shield. Until there is an approved replacement, the CNIL and CJEU maintain that Google Analytics is illegal in the region, and it’s something advertisers and international businesses must keep in mind. As we look to a future where third-party data collection is no longer an acceptable practice, brands should solidify their first-party and zero-party data strategies, lean into their user experiences, and re-shape business goals in light of changing privacy expectations.
Need help sorting through the latest developments in privacy laws? We can help. Explore our Marketing Pulse Dashboard for the latest trends in marketing, and visit the blog to learn more about data privacy and other timely topics.
Featured image by Anthony Beck on Pexels.
Get industry insights and news directly to your inbox.
Thank you. Check your email for details on your request.
Cookie | Duration | Description |
---|---|---|
__hssrc | session | This cookie is set by Hubspot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session. |
checkForPermission | 10 minutes | This cookie is set by Beeswax to determine whether the user has accepted the cookie consent box. |
cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category . |
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
CookieLawInfoConsent | 1 year | Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie. |
elementor | never | This cookie is used by the website's WordPress theme. It allows the website owner to implement or change the website's content in real-time. |
JSESSIONID | session | The JSESSIONID cookie is used by New Relic to store a session identifier so that New Relic can monitor session counts for an application. |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
Cookie | Duration | Description |
---|---|---|
__cf_bm | 30 minutes | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
__hssc | 30 minutes | HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. |
bcookie | 2 years | LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser ID. |
bscookie | 2 years | LinkedIn sets this cookie to store performed actions on the website. |
lang | session | LinkedIn sets this cookie to remember a user's language setting. |
lidc | 1 day | LinkedIn sets the lidc cookie to facilitate data center selection. |
UserMatchHistory | 1 month | LinkedIn sets this cookie for LinkedIn Ads ID syncing. |
Cookie | Duration | Description |
---|---|---|
_uetsid | 1 day | Bing Ads sets this cookie to engage with a user that has previously visited the website. |
_uetvid | 1 year 24 days | Bing Ads sets this cookie to engage with a user that has previously visited the website. |
Cookie | Duration | Description |
---|---|---|
__hstc | 1 year 24 days | This is the main cookie set by Hubspot, for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session). |
__lotl | 5 months 27 days | This cookie is set by Lucky Orange to identify the traffic source URL of the visitor's orginal referrer, if any. |
_ga | 2 years | The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors. |
_gcl_au | 3 months | Provided by Google Tag Manager to experiment advertisement efficiency of websites using their services. |
_gd_session | 4 hours | This cookie is used for collecting information on users visit to the website. It collects data such as total number of visits, average time spent on the website and the pages loaded. |
_gd_svisitor | 2 years | This cookie is set by the Google Analytics. This cookie is used for tracking the signup commissions via affiliate program. |
_gd_visitor | 2 years | This cookie is used for collecting information on the users visit such as number of visits, average time spent on the website and the pages loaded for displaying targeted ads. |
_gid | 1 day | Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously. |
_hjAbsoluteSessionInProgress | 30 minutes | Hotjar sets this cookie to detect the first pageview session of a user. This is a True/False flag set by the cookie. |
_hjFirstSeen | 30 minutes | Hotjar sets this cookie to identify a new user’s first session. It stores a true/false value, indicating whether it was the first time Hotjar saw this user. |
_hjIncludedInPageviewSample | 2 minutes | Hotjar sets this cookie to know whether a user is included in the data sampling defined by the site's pageview limit. |
_lo_uid | 2 years | This cookie is set by Lucky Orange as a unique identifier for the visitor. |
_lo_v | 1 year | This cookie is set by Lucky Orange to show the total number of visitor's visits. |
_lorid | 10 minutes | This cookie is set by Lucky Orange to identify the ID of the visitors current recording. |
hubspotutk | 1 year 24 days | HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts. |
IR_gbd | session | Impact Radius sets this cookie to store a unique ID which is used to identify the user's device, when they return to the websites that used the same network. |
Cookie | Duration | Description |
---|---|---|
__qca | 1 year 26 days | The __qca cookie is associated with Quantcast. This anonymous data helps us to better understand users' needs and customize the website accordingly. |
_fbp | 3 months | This cookie is set by Facebook to display advertisements when either on Facebook or on a digital platform powered by Facebook advertising, after visiting the website. |
_mkto_trk | 2 years | This cookie, provided by Marketo, has information (such as a unique user ID) that is used to track the user's site usage. The cookies set by Marketo are readable only by Marketo. |
B | 1 year | This Cookie is used by Yahoo to anonymously store data related to user's visits, such as the number of visits, average time spent on the website and what pages have been loaded. This data helps to customize website content to enhance user experience. |
bito | 1 year 1 month | This cookie is set by Beeswax for advertisement purposes. |
bitoIsSecure | 1 year 1 month | Beeswax sets this cookie for targeting and advertising. The cookie is used to serve the user with relevant advertisements based on real time bidding. |
fr | 3 months | Facebook sets this cookie to show relevant advertisements to users by tracking user behaviour across the web, on sites that have Facebook pixel or Facebook social plugin. |
mc | 1 year 1 month | Quantserve sets the mc cookie to anonymously track user behaviour on the website. |
MUID | 1 year 24 days | Bing sets this cookie to recognize unique web browsers visiting Microsoft sites. This cookie is used for advertising, site analytics, and other operations. |
test_cookie | 15 minutes | The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies. |
tuuid | 2 years | The tuuid cookie, set by BidSwitch, stores an unique ID to determine what adverts the users have seen if they have visited any of the advertiser's websites. The information is used to decide when and how often users will see a certain banner. |
tuuid_lu | 2 years | This cookie, set by BidSwitch, stores a unique ID to determine what adverts the users have seen while visiting an advertiser's website. This information is then used to understand when and how often users will see a certain banner. |
Cookie | Duration | Description |
---|---|---|
__pdst | 1 year | No description available. |
_an_uid | 7 days | No description available. |
_dc_gtm_UA-61749619-1 | 1 minute | No description |
_dlt | 1 day | No description |
_hjSession_1771567 | 30 minutes | No description |
_hjSessionUser_1771567 | 1 year | No description |
_nx-nocache | session | No description available. |
6suuid | 2 years | No description available. |
A3 | 1 year | No description |
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ | session | No description |
AnalyticsSyncHistory | 1 month | No description |
BIGipServerab44web-nginx-app_https | session | No description |
bounceClientVisit3783c | 30 minutes | No description |
bounceClientVisit3783v | 30 minutes | No description |
dgzsdl08v4 | 10 minutes | No description |
IR_11658 | session | No description |
li_gc | 2 years | No description |
tableau_locale | session | No description available. |
tableau_public_negotiated_locale | session | No description available. |
test | 1 year | No description available. |