The agency added the Google Analytics tag in 2019, the day the site went live. Nobody has touched it since. The dashboard exists, but the last person who opened it left the company. And yet, on every visit, the script loads, drops its identifier and sends the browsing data to the tool's servers. That is the situation on a large share of French small-business websites. It raises two separate questions, and this article keeps them apart: where does the data go, and did the visitor agree before the tracker was set? The fixes come first, because they are more useful than reminders about enforcement.
Disclaimer: this article is provided for information only and does not constitute legal advice. The texts cited are those in force at the time of writing; for a specific situation, consult a qualified legal professional.
Open your site with the browser's developer tools ("Network" tab) and answer these three questions.
If the script waits for consent, the transfer basis is documented and the statistics are used, the rest of this article confirms what you already have in place. If not, it tells you where to start.
On 10 February 2022, the CNIL announced that it had served a formal notice on a website operator over the use of Google Analytics and the resulting transfers of data to the United States. Further formal notices followed, in cooperation with other European supervisory authorities. The reasoning: browsing data was leaving for the United States without sufficient safeguards for the rights of the people concerned. The CNIL records this in its 2022 annual report and in its review of its 2022 enforcement activity. The organisations concerned are not named here: what matters for your site is the reasoning.
In June 2022, the CNIL published questions and answers about those formal notices, announced in its June 2022 newsletter. Their technical substance now lives on the CNIL page "Mesure d'audience et transferts de données" (audience measurement and data transfers). Two points to keep:
Chapter V of the GDPR governs transfers of personal data to third countries. Article 44 states the principle: a transfer takes place only if the conditions of the chapter are met. Article 45 allows transfers to a country covered by an adequacy decision of the European Commission. Failing that, article 46 requires appropriate safeguards, such as standard contractual clauses.
On 16 July 2020, the Court of Justice of the European Union delivered its judgment in case C-311/18. It declared adequacy Decision 2016/1250 (the "Privacy Shield"), which had covered transfers to the United States, invalid, while holding that Decision 2010/87 on standard contractual clauses remained valid. From that date on, a French site sending its visitors' data to a US provider could no longer rely on an adequacy decision. That is the position of Google Analytics as installed by default, and it is what the CNIL found in 2022.
On 10 July 2023, the European Commission adopted Implementing Decision (EU) 2023/1795 on the EU–US Data Privacy Framework (DPF). It finds that the United States ensures an adequate level of protection for personal data transferred to US organisations that adhere to the framework's principles and appear on the list maintained by the US Department of Commerce (CNIL news item of 10 July 2023).
| Question | Settled by the 2023 decision? | What is still yours to do |
|---|---|---|
| Transfer to a US organisation on the DPF list | Yes, on the basis of article 45 of the GDPR | Confirm the provider is on the list and date that check (CNIL questions and answers) |
| Transfer to a US organisation not on the list | No | The tools of article 46 of the GDPR, for example standard contractual clauses |
| Setting the tracker on the visitor's device | No, separate question | Prior consent, or the exemption conditions (article 82 of the Loi Informatique et Libertés) |
| Informing visitors | No | Tool, purpose, retention and any transfer in the privacy policy (article 13 of the GDPR) |
The third row is the one most often misunderstood. The 2023 decision is about where the data ends up. It says nothing about the moment the tracker is set. That second question is governed by article 82 of the Loi Informatique et Libertés and by the CNIL guidelines of 17 September 2020 (deliberation no. 2020-091), and it has not moved. How the banner has to behave is covered in the article on the "Reject all" button; the transfer basis for your other providers in the article on international data transfers.
Article 82 asks that the user be informed and have given consent before anything is read from or written to their device, unless the operation has the exclusive purpose of enabling electronic communication or is strictly necessary for a service the user has requested. Article 5 of deliberation no. 2020-091 sets out when an audience-measurement tracker falls under that second exception; the CNIL restates the conditions on its page "Solutions pour les outils de mesure d'audience". The tracker must:
The same page recommends informing people in the privacy policy, capping the tracker's lifetime at 13 months without automatic renewal, and capping data retention at 25 months. A tool that sends data to a provider for that provider's own purposes, or that links the visitor to other sites, falls outside the exemption whatever its name.
(a) A tool configured to meet the exemption conditions. Three categories: self-hosted tools on your own server (Matomo is one example), tools hosted by a provider established in the European Union (Plausible or Piwik PRO, for example), and the statistics your hosting provider derives from server logs. These names illustrate categories, with no statement about their status: what counts is the configuration you choose, not the brand. Most offer an "exemption" mode that switches off cross-referencing and cross-site tracking; it is checked setting by setting and documented.
(b) Keeping Google Analytics, with consent before loading and a documented transfer analysis. The script loads only after "Accept all", with a "Reject all" just as easy to reach. The transfer is documented: the provider's presence on the DPF list on a recorded date, a mention in the privacy policy and in the record of processing activities. The price: a partial statistic, because visitors who refuse disappear.
(c) A proxy server. On its page "Mesure d'audience et transferts de données", the CNIL lists the measures the proxy implements: no IP address passed on, user identifier replaced with a variable time component, external referrer and URL parameters (UTM, internal routing) removed, browser-fingerprint information reprocessed, no cross-site or deterministic identifier, removal of any data that could lead to re-identification, and hosting that rules out any transfer to a country without equivalent protection. This is an engineering project, rarely justified for a small business.
(d) Asking whether audience measurement is needed at all. If nobody reads the dashboards, removing the tag removes the tracker, the transfer, the line in the record of processing and the paragraph in the privacy policy. Server logs are often enough.
| Option | Consent? | Transfer outside the EU? | Effort | Who it suits |
|---|---|---|---|---|
| (a) Tool configured under the exemption (deliberation no. 2020-091, art. 5) | No, if every condition is met | No, if hosted in the EU | Low to medium | Most brochure sites and online shops |
| (b) Google Analytics with consent (art. 82 LIL) and a DPF analysis (Decision (EU) 2023/1795) | Yes | Yes, to be documented | Medium | Sites that depend on the tool's advertising features |
| (c) Proxy following the measures described by the CNIL | Depends on the final configuration | Pseudonymised data only | High | Technical teams with a specific need |
| (d) Removing the tool | No | No | Minimal | Sites where nobody reads the statistics |
On WordPress, the analytics plugin and the consent manager are configured from the admin area; the WordPress and CNIL 2026 guide walks through the order of operations.
The free Sitetals check reviews your home page and reports, among other things, whether a legal notice page or a privacy policy page is missing or unreachable, and which third-party services your site loads. It is a starting point for the review described above, not a replacement for it.
Also worth reading:
Sources: Regulation (EU) 2016/679, articles 13, 44, 45 and 46 · Law no. 78-17 of 6 January 1978, article 82 · CNIL deliberation no. 2020-091 of 17 September 2020, article 5 · CJEU, judgment of 16 July 2020, case C-311/18 · Implementing Decision (EU) 2023/1795 of 10 July 2023 · CNIL, 2022 annual report · CNIL, "Mesure d'audience et transferts de données" · CNIL, "Solutions pour les outils de mesure d'audience" · CNIL, "Adéquation des États-Unis : les premières questions-réponses" · Sitetals methodology.
Sitetals editorial team