In July, we shared the news of the adoption of the EU-US Data Transfer Agreement. It paved the road for once again using GA4 and other US-based tech tools legally. In this article, you can read an update on the US-based companies & our produced FAQ with valuable takeaways.
As of today (30/8/2023), a total of 2,489 US-based companies have self-certified for the EU-US Data Protection Framework (DPF), and all well-known tech companies have been certified, such as Google, Meta, Microsoft etc.
Google has announced that they will update their data protection terms to comply with the new requirements, which will apply as of 1 Sep 2023. The US has also reached a formal agreement with the UK and Switzerland to establish a similar legal framework to facilitate the transfer of personal data from the UK and Switzerland to the US. A few formalities await UK and Switzerland approvals, but are expected within the near future.
To help navigate this evolving landscape, we have prepared the following FAQs for you.
Yes, but note that Goggles certification under the US/EU DPF does not in itself guarantee that Google Analytics is approved as being GDPR compliant. Google must continue actively to comply with other GDPR requirements which applied before the US/EU DPF.
The whole issue surrounding Google Analytics and other US tech tools arose after the previous data transfer agreement between the USA and the EU, known as “Privacy Shield”, was invalidated on July 16th, 2020 (Schrems II). All stakeholders, users, companies, and authorities using tools like Google Analytics 4 have therefore had a great common interest in establishing a new privacy framework, which is why the adoption of this has been long-awaited.
With the decision on Monday 10th July from the EU, the path is clear for software tools like Google's GA4, Meta's Pixel, etc., to be used legally.
You can check if a company is certified by visiting the U.S. Department of Commerce website and clicking on the "Data Framework Privacy List" tab.
Popular marketing tools such as GA4 have terms and conditions for the use of personal data stipulated in their online terms applicable to the use of the platforms. We always encourage our customers to review these on a regular basis.
Google has announced that it will update its data protection terms to comply with the new requirements, which will apply as of 1 Sep 2023.
The above cannot replace legal counselling. s360 and its employees do not offer legal counselling in any form, including circumstances surrounding the setup and use of websites and media platforms. s360 does not accept any form of responsibility in regards to direct or indirect losses as a consequence of the use of this article, including loss following from inadequate or wrongful use of information, evaluations or other conditions. s360 recommends seeking legal counselling from a qualified lawyer if you are in doubt about any legal requirements and conditions, GDPR compliance and/or use of data.
Stay updated on the case and future updates regarding this.