Is Google Analytics illegal in France?

Short answer: no. In 2026 a French website can use Google Analytics 4 legally. It cannot do so without asking visitors for consent, though, and the legal basis that covers sending the data to the United States is still being challenged in the EU courts. This is how it got here and what it means for a site owner. It is general information, not legal advice.

2022: the CNIL finds the transfers unlawful

In July 2020 the Court of Justice of the EU struck down the Privacy Shield, the agreement that covered transfers of personal data to the United States (the Schrems II ruling). The noyb association then filed 101 complaints against European websites that used Google Analytics.

On 10 February 2022 the CNIL announced that it had ordered a French website to comply: the data sent to Google in the United States was not protected enough, in breach of articles 44 and following of the GDPR. The site had one month, and the CNIL said other procedures of the same kind were under way. The Austrian authority had reached a similar decision in January 2022, the Italian one followed in June 2022, and the Swedish authority issued fines in July 2023.

For sites that wanted to keep the tool, the CNIL described one solution in 2022: a proxy server that cuts any direct contact between the visitor and Google. It is a heavy setup, and few sites built it.

2023: the Data Privacy Framework

On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Google LLC is certified under it, which makes transfers to Google lawful again.

The framework is fragile. Philippe Latombe, a French member of parliament who also sits on the CNIL's board, challenged it in his own name (case T-553/23). The EU General Court dismissed the case in September 2025, and it is now under appeal at the Court of Justice. The two previous agreements were struck down in 2015 and 2020. If this one falls too, the transfer question comes back.

What does not change: consent

Transfers are only part of the story. Article 82 of the French data protection act requires consent before storing or reading trackers on a visitor's device, with some exceptions. GA4 sets the _ga and _ga_<id> cookies, kept for up to two years.

The CNIL allows an exemption for audience measurement under strict conditions: measurement for the site owner only, anonymous statistics, no tracking across sites, no reuse by the provider. Google Analytics has never been among the tools the CNIL considered able to qualify, and its advertising features (the Google Ads link, Google signals) count as marketing in the self-assessment the CNIL published in July 2025. In practice, GA4 only loads after a click on "Accept".

Google's Consent Mode v2, required since March 2024 for advertising features in the European Economic Area, does not change that rule. In advanced mode it sends cookieless pings before the visitor chooses, and GA4 then models the missing data. Those pings also read information from the device, and article 82 is not limited to cookies. What the modelled numbers are worth is in GA4 consent mode and modelled data.

The CNIL checks cookies

In recent years the CNIL's fines have mostly been about cookies set without valid consent. Google was fined 100 million euros in 2020, 150 million announced in January 2022 and 325 million in September 2025; Shein 150 million on the same day. These decisions are not about using Google Analytics on a site, but they show that the banner and respect for a refusal get checked.

What it means for your site

• You keep GA4. It stays behind the banner, only measures visitors who accept, and your privacy policy mentions the transfer to Google. Follow the appeal in the Latombe case.
• You move to a tool set up for the exemption. It counts every visitor, including those who decline the banner, as long as it meets the CNIL criteria. Matomo allows it with its CNIL configuration (see Matomo and the CNIL exemption), Statsdot with its CNIL exemption mode, and our self-assessment goes through each criterion.
• You do both. Many sites keep GA4 or Google Ads behind the banner for advertising, and an exempt tool for traffic. The banner stays, but your visit numbers no longer depend on refusals.

To see what your site loads today, run its home page through our free site check. The wider EU picture is in Google Analytics and the GDPR in 2026.