• Badge: ⚠️ Caution
• Red Flags:
  • RF1 — Own advertising / cross-service profiling
  • RF2 — High-risk third-country exposure without meaningful mitigation
• Risk Indicators:
  • Own-purpose data use (advertising); intrusive tracking; high-risk international transfers

Key Facts: Google processes GA data for its own advertising ecosystem, including audience building and cross-service profiling, unless the controller actively disables Advertising Features. Data is transferred to US servers. EU DPAs have ruled these transfers unlawful: Austria DSB (Jan 2022), French CNIL (Feb 2022), Italian Garante (Jun 2022), Danish Datatilsynet (Sep 2022), Swedish IMY (Jul 2023), Norwegian Datatilsynet (Jan 2025). While the EU–US Data Privacy Framework (Jul 2023) provides a current transfer basis, a CJEU appeal (Case C-703/25 P) challenging the DPF's adequacy is pending.

Framework Note (v2.2): FRAMEWORK NOTE (v2.2): RF2 (high-risk third-country exposure) is recorded here as a significant risk factor and lowers the domain E score. Under the revised framework, RF2 alone does not trigger Caution — the Caution badge for this service is driven by RF1 / RF3 / RF4 (as noted above). The US transfer risk (where applicable) is covered by DPF participation and/or SCCs, which GDPR treats as a compliant transfer mechanism.

Quellen:

• Google Analytics Terms of Service (analytics.google.com/analytics/tos)
• Google Privacy Policy (policies.google.com/privacy)
• Austrian DSB decision (DSB-D123.270/0009-DSB/2021
• Jan 2022)
• CNIL order (Jan/Feb 2022)
• Norwegian DPA guidance (Feb 2025)
• CJEU case register.

• Support marketing analytics

• TPP Notified?: Not yet notified
• Decision Contested?: [nicht dokumentiert]