Google LLC’s Analytics service, the largest of its kind in the world, could be handing French people’s data to U.S. intelligence services, France’s watchdog CNIL said today.

CNIL said Google Analytics breaches article 44 of Europe’s General Data Protection Regulation, GDPR, and the tech giant hasn’t done enough to ensure data protection. It added that Google doesn’t provide users with enough information on what happens to their data and how it’s being used and doesn’t offer enough avenues for recourse if people do think their data has been misused.

On its website, CNIL reported that the Austrian-based European Center for Digital Rights had received 101 complaints from 27 E.U. member states as well as three other European Economic Area states, regarding Google’s transfer of data to the U.S.

“Although Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for US intelligence services,” said CNIL. “There is therefore a risk for French website users who use this service and whose data is exported.”

It seems that the CNIL will give Google a chance to make things right, but this will mean making a lot of changes. It said that only “anonymous statistical data” should be transferred, which according to reports might even mean that an IP address could be too much given that it could be used to identify a person.

It added that how things stand, Google Analytics is not compliant with the law, and in one current case told an unnamed site manager that if it cannot meet the regulations, it should cease to use Google Analytics. “The CNIL has issued other orders to comply to website operators using Google Analytics,” it said.

Google hasn’t commented on the matter but has said in the past that it doesn’t track people with its analytics service and people who use it have full control over their data. With this news and the fact that the data flow deal between the U.S. and the E.U. – Privacy Shield – was scrapped in 2020, it could mean that Google and other U.S. tech companies will have to start storing their data on European servers.

Photo: dariorug/Flickr