Schrems III: What Happens to Google Analytics Now

Two EU-US data deals have died in court: Safe Harbour in 2015, Privacy Shield in 2020. Each time, Google Analytics kept its EU users through the wreck. The third deal is now in front of the same court, weaker than either of its predecessors. This time the crack came from Washington, not Luxembourg.

I've covered the legal history of Google Analytics in Europe before. This piece is about what changed this summer, and what it means for you if you run GA today. I'm not here to scare you. Nothing's illegal this morning. But if you were around for the last two rounds, you know how this movie tends to end.

What just happened to the EU-US data deal

On June 29, 2026, the US Supreme Court ruled in Trump v. Slaughter that the president can fire FTC commissioners at will. The FTC is the agency that polices the EU-US Data Privacy Framework, the deal that lets Google move EU visitor data to US servers. The framework's own text leans on the FTC as an independent watchdog, 259 times by noyb's count. That means the deal's main enforcer now serves at the pleasure of one man.

EU law requires that watchdog to be independent. US law now says it can't be.

Max Schrems saw the opening within hours: "Given that there are no independent authorities in the US anymore, we call on the European Commission to orderly withdraw the adequacy decision on the US." The EDPB followed on July 31, formally asking the Commission to assess the damage. The Commission has said nothing of substance since.

Three data deals, two dead, one in court

Here's the part most coverage misses: the court test isn't hypothetical. French MP Philippe Latombe challenged the framework, lost in September 2025, and appealed to the CJEU in October. That appeal is pending right now. noyb's threatened "Schrems III" case would be a second front, filed with the Supreme Court ruling as fresh ammunition.

The first two cases took 16 and 26 months from referral to ruling. Which means a decision could plausibly land in 2027 or 2028. Far enough away that you shouldn't panic. Close enough that you shouldn't ignore it.

What happens if the framework falls

Not what you'd think. An adequacy decision falling doesn't fine anyone. It removes the legal basis for transfers, and everything shifts to the fallback: Standard Contractual Clauses. The law firm Hunton put it plainly: the immediate effect is "greater legal uncertainty, rather than any immediate change to the legal basis for cross-border data transfers."

So there's no day-one raid. But there's also no cushion. When Privacy Shield died in 2020, the EDPB confirmed there was no grace period. In practice, transfers that relied on it were non-compliant the same afternoon, and every affected company found out from the news.

And here's the trap in the fallback. SCCs only work if US law lets Google honor them, and the EU's own regulators spent 2022 ruling that it doesn't. If the framework falls, GA doesn't land on safe ground. It lands on the exact ground six regulators already condemned, and you land there with it.

The last time there was no deal

Between July 2020 and July 2023, there was no EU-US framework at all. That gap is the best preview of a post-DPF world, because we watched it happen:

Read that last line again. Sweden fined companies roughly 1 million euros for a legal gap that closed one week later. Put another way: when the deal's gone, regulators don't wait for you to sort things out, and they don't care if a fix is seven days away.

What Google's own paperwork says

I read Google's transfer documentation so you don't have to. Two things stand out.

First, Google's ads and analytics transfer page says it relies on the Data Privacy Framework for moving EEA personal data to the US, with SCCs as the fallback where the framework doesn't apply. The fallback is the already-condemned regime from the table above.

Second, GA4's "EU data residency" is narrower than it sounds. Google's own support page says EU servers handle the initial collection and IP lookup before "forwarding traffic to Analytics servers for processing." It doesn't say where those servers are. Which means there's no EU-only processing guarantee, and the visitor data you collect still ends up in Google's global infrastructure.

That's not a bug in your setup. You can't configure your way out of it. It's the architecture.

What to do now (and what not to do)

Don't panic-migrate over a headline. The framework's in force today, and even the law firms telling clients to prepare are also telling them transfers remain valid while the court decides.

Do know your exposure. If the analytics, pixels, and email tools you run are US-based, the framework is the thread they all hang on. You've now watched that thread snap twice.

And know which category simply isn't in this movie: tools that are EU-owned and EU-hosted never transfer your visitors' data to the US, so there's no transfer for any court to invalidate. That's the structural fix. Not a setting, not a consent banner: jurisdiction.

Clickport is in that category by design. Your visitor data lives on Hetzner servers in Germany and never leaves the EU, so Schrems rulings are something I write about, not something I brace for. You can try it free for 30 days, and if the DPF news is your reason, switching from Google Analytics takes one snippet.

The first two frameworks lasted 15 and 4 years. That means each deal died faster than the one before it. The third is 3 years old, and both of its predecessors looked permanent right up until a court said otherwise.

FAQ

Is the Data Privacy Framework still valid? Yes. The adequacy decision is in force, and transfers under it are legal today. It's under review at the CJEU (the Latombe appeal) and facing a threatened second challenge from noyb.

Has Schrems III been filed? No. As of August 2026, noyb has demanded the Commission withdraw the framework and announced a lawsuit, but no case has been filed yet. The name "Schrems III" is shorthand for the expected challenge.

Is Google Analytics banned in France? France's CNIL ruled in February 2022 that GA transfers violated the GDPR and gave sites one month to comply. That enforcement wave paused when the DPF restored a legal basis in July 2023. It wasn't a permanent ban, and it would resurface if the framework falls.

Is Schrems II still valid? Yes. Schrems II still governs the fallback: SCCs are valid only if the destination country's law lets them work, which is exactly the test US surveillance law kept failing in 2022.

When would a Schrems III ruling land? The first two cases took 16 and 26 months from referral to ruling. If a challenge is filed in 2026, most lawyers expect a decision in the 2027-2028 range.