The ban on personal data transfer to the U.S. through Google Analytics: practical analysis of the Italian Data Protection Authority's Deliberation as of June 9th, 2022.

As already ascertained by other European data protection authorities (eg: the French CNIL or the Austrian data protection authority, in similar decisions), the Italian Data Protection Authority has also established that websites that use the Google Analytics service without guarantees provided for by the GDPR infringe the data protection rules because through the service they collect, through cookies, and transfer personal data of users in the United States, a country currently lacking an adequate level of protection.

The data transferred is information on user interactions with the aforementioned web sites such as data on: individual pages visited, services offered, the IP address of the user's device, information relating to the browser, operating system, screen resolution, the selected language, as well as the date and time of the visit to the website.

In this article, Prof. Avv. Alessandro del Ninno analyzes the practical scope and operational implications of the ban on the use of Google Analytics without the prescribed guarantees provided by the GDPR for the international transfer of personal data to countries without an adequate level of protection.