The Danish data protection authority ('Datatilsynet') announced, on 21 September 2022, that, following its review of the Google Analytics tool, its settings, and the terms under which the tool is provided, it concluded that the tool cannot be used lawfully. In particular, the Datatilsynet stated that its decision falls within the common European position among supervisory authorities on the use of Google Analytics. As such, the Datatilsynet noted that Danish organisations using Google Analytics should assess whether their use takes place in compliance with data protection law, and, if not, should implement a plan to bring such use into compliance by implementing supplementary measures. In this regard, the Datatilsynet specified that one possible technical measure that can be used by organisations as a supplementary measure is pseudonymisation.

Furthermore, the Datatilsynet noted that it cannot rule out that there may be circumstances or technical settings which it had not taken into account, and therefore invites organisations and persons who have special insight into the relevant tool to write to the Datatilsynet here if they believe that there are circumstances the Datatilsynet has not taken into account. Additionally, the Datatilsynet has issued questions and answers ('Q&A') on the use of Google Analytics and further information on the decisions of supervisory authorities.

You can read the press release here and the Q&A here.