GDPR-Compliant Analytics in 2026: The Post-Schrems II Playbook for SMB SaaS

A SaaS founder I worked with in March 2026 had a clean GA4 setup. Consent Mode v2, IAB TCF v2.2, Cookiebot CMP, server-side GTM proxying through an EU-region Cloud Run instance. Her lawyer signed off on it. Her DPO signed off on it. Six weeks later her enterprise prospect's procurement team flagged "Google Analytics in US transfer flow" on a vendor questionnaire and the deal stalled for nine weeks while she swapped to a cookieless EU-hosted tool. The legal stack was defensible. The procurement stack was not. By the time she shipped the migration the deal had moved to a competitor.

That is the operational gap I keep watching close up. GDPR-compliant analytics in 2026 is not just a legal question, it is a procurement-and-trust question, and the two have diverged. The legal answer for most SMB SaaS is "GA4 with the right contractual safeguards is probably defensible." The procurement answer for any deal that touches European enterprise, healthcare, finance, or public sector is "cookieless, EU-residency, no US transfer." This article is the longer companion to the GDPR analytics compliance overview. The earlier piece walked the architecture. This one walks the 2024-2026 enforcement, the post-Schrems II reality, the Digital Omnibus, the EU AI Act overlap, and the migration playbook.

Quick Facts

Two of those numbers are doing most of the work. The "6 EU DPAs with adverse rulings" is the supply-side fact — the enforcement environment is real, not theoretical. The "40-55% EU cookie banner consent rate" is the demand-side fact — even when GA4 is legally defensible, the data quality you get out of it after a compliant banner is a fraction of what a cookieless architecture sees. Either of those facts alone is enough to move a thoughtful operator off GA4. Both together are why the cookieless analytics category has grown from "Plausible and Fathom" in 2020 to a dozen credible vendors in 2026.

The 2024-2026 EU Analytics Enforcement Timeline

The post-Schrems II enforcement timeline matters because it shows the trajectory, not just the snapshot. Six DPAs ruling adversely against the same product over 24 months is a pattern, not a coincidence. The pattern is what the Schrems III court will look at when it weighs whether the DPF has materially changed the surveillance-access risk that caused Schrems II.

The cadence is the story. Six DPAs in 24 months, one EU adequacy decision, one new AI regulation, one Omnibus proposal, one Schrems III queue. None of those events made GA4 illegal. All of them made it riskier. Most operators read the timeline as noise; the procurement teams at European enterprise buyers read it as a trend line and update their vendor checklists accordingly.

The timeline diagram makes the cadence visible. Each year since 2020 has added either a new ruling, a new regulation, or a new enforcement decision. None has reversed the previous one. The legal direction of travel is one-way.

Why GA4 + Consent Mode v2 Is Not a Compliance Solution

This is the section most analytics consultants will not write because it interferes with the GA4 implementation business. The honest version: Consent Mode v2 is a useful operational improvement for the consent flow. It is not, and does not pretend to be, an answer to the Schrems II residency problem. The two issues are orthogonal.

The DPF and Consent Mode v2 are doing different jobs. Consent Mode v2 handles the consent question — does the user agree to be tracked. The DPF handles the transfer question — is the resulting data lawfully transferable to a US controller. A site can satisfy one and still fail the other. A site can satisfy both and still be one CJEU ruling away from non-compliance.

The architectural critique is sharper. Consent Mode v2 is a client-side modification of the GA4 tag's behavior under different consent states. It does not move the data. It does not change the controller. It does not move the processing infrastructure. It is, in the most literal sense, duct tape — a workaround that lets the existing system continue operating across a problem the existing system was not designed for. The problem (Schrems II residency) is architectural; the workaround (Consent Mode v2) is configurational. Architectural problems do not have configurational solutions.

The right column is what fixes the problem. The left column is what most teams ship because it is faster. The procurement teams at European enterprises read the left column as "still using a US provider" and the right column as "actually EU-native." On large deals, that reading is the deciding factor.

A real example from a 2026 audit. A US-headquartered SaaS company shipped server-side GTM through a Frankfurt-region Cloud Run instance, IP redaction at the edge, Consent Mode v2, IAB TCF v2.2 banner, and SCCs with their German subsidiary as the EU controller. The German enterprise prospect's privacy team requested a Transfer Impact Assessment. The TIA concluded the architecture was defensible but that the underlying data flow still terminated at Google US. The prospect's privacy team requested the vendor either (a) move to a non-US analytics provider or (b) accept a contractual penalty clause for any future DPF invalidation. The vendor chose option (a). Total project cost: roughly EUR 40,000 in implementation and migration. Total time lost: 11 weeks. The original GA4 setup was technically legal. It was not commercially viable for the deal.

The 4 Architectural Approaches to GDPR-Compliant Analytics

Strip away the marketing language and there are four architectural approaches to analytics in 2026. Each makes different trade-offs across consent friction, data quality, residency risk, and integration depth. Most teams pick by familiarity rather than by fit, then discover the mismatch at month 6 when EU traffic grows or a procurement question hits.

Approach 1 is the GA4 path and dominates by deployment count. Approach 2 is the cookieless category and dominates by EU procurement preference. Approach 3 is the engineering-heavy path that adds operational control without changing the underlying provider's jurisdiction. Approach 4 is the compromise that gives feature parity with US-built tools but locates the data in the EU.

The decision tree is mechanical. The two pivots are EU traffic share and enterprise procurement exposure. Most SMB SaaS lands in approach 2 (cookieless first-party). Most enterprises with engineering teams land in approach 3 (server-side proxy). The minority that lands in approach 1 are sites with under 15% EU traffic, no enterprise deals on the roadmap, and an existing GA4 dependency they do not want to disrupt.

The approach-2 architecture in one picture, with the cookieless first-party flow:

The diagram is the entire mechanism. The visitor browser receives nothing persistent. The server holds a hash long enough to count uniques within a day. The Stripe webhook adds revenue context server-to-server. The salt rotation breaks cross-day re-identification. There is no client storage to consent for, no third-party transfer to declare, no behavioral fingerprint to defend in a DPIA.

ePrivacy vs GDPR: The Consent Banner Trigger

The two laws answer different questions. ePrivacy Article 5(3) is about the act of storing or accessing information on a user's device. GDPR is about the subsequent processing of personal data. Most analytics conversations conflate them, which is why "do I need a banner?" gets confusing answers.

The penalty cap column matters because it shows the regulatory weight. The AI Act's 7% cap is higher than GDPR's 4%, which is a deliberate signal that automated decision-making is being treated more seriously than baseline data processing.

The ePrivacy / GDPR interaction in flowchart form:

The flowchart is the legal reasoning in one picture. ePrivacy is the first gate. GDPR is the second gate. Chapter V (Schrems II) is the third gate. An analytics tool can pass the first two gates and fail the third. A cookieless tool with EU residency passes all three without consent. A standard GA4 deployment without DPF reliance fails the third. GA4 with DPF reliance passes all three until the DPF gets invalidated.

The CNIL audience-measurement exemption is the most operative escape hatch under ePrivacy 5(3). The four conditions:

Plausible's data policy documents compliance with all four. Fathom's data policy documents compliance. Pirsch's privacy documentation claims compliance. Simple Analytics publishes the same posture. Matomo in self-hosted EU mode with cookies disabled claims compliance. Attrifast ships approach 2 (cookieless first-party) with all four conditions met and EU residency as the default.

The exemption is binding in France. It is persuasive (not binding) in other EU jurisdictions because the EDPB has not formally adopted it as an EU-wide guideline. In practice, most EU DPAs treat the CNIL exemption as good-faith compliance under Article 29 Working Party / EDPB consistency principles. The German DSK has historically been the strictest national authority on cookie consent; the DSK orientation guide for telemedia providers (most recently updated 2024) is more conservative than the French CNIL position but does not contradict the exemption mechanism, just the threshold for relying on it.

Real DPA Decisions: Case Studies from France, Austria, Italy, Netherlands

Three actual rulings worth knowing by case number. These are the precedents lawyers cite in vendor questionnaires and the patterns that procurement teams update their checklists against.

Austrian DSB, netdoktor.at (DSB-D213.679/0001-DSB/2021)

The Austrian Datenschutzbehörde published its decision on January 12, 2022. The complaint was brought by NOYB on behalf of an EU resident whose visit to netdoktor.at had triggered Google Analytics, which transmitted the user's Client ID, IP address, and HTTP header data to Google LLC servers in the United States. The DSB found that:

Outcome: violation finding, no immediate fine (the operator had ceased GA usage by the time of the decision). Source: NOYB case summary and the published DSB decision [13]. The Austrian decision was the first national-level Schrems II ruling against GA and the template that France, Italy, Denmark, Norway, and Finland followed.

French CNIL, formal notice February 10, 2022

The CNIL issued formal notices to multiple website operators (anonymized in the public communication) requiring them to bring GA usage into compliance within one month. The CNIL's published position:

Outcome: compliance order, no monetary fine in the published cases. Source: CNIL public statement [14]. The CNIL position is the most-cited regulatory text in cookieless analytics marketing because it explicitly leaves space for a compliant architecture (the audience-measurement exemption) while ruling against the dominant tool.

Italian Garante, Caffeina Media srl (Provvedimento 9782890)

The Italian Garante published its decision on June 23, 2022. Caffeina Media srl, a digital publisher, was found to be transferring personal data via standard GA Universal to Google in the US without supplementary safeguards. The Garante's order:

Outcome: compliance order with a 90-day deadline. Source: Garante decision text [15]. The Italian ruling is the one most commonly cited in Italian-language vendor questionnaires.

Norway Datatilsynet, June 2023 advisory

Norway is an EFTA member, bound to GDPR through the EEA Agreement. The Datatilsynet's June 2023 advisory built on the Austrian, French, and Italian rulings and concluded that standard GA usage by Norwegian operators violated the GDPR transfer regime [17]. The advisory predates the DPF adoption (July 10, 2023) by weeks. The Datatilsynet has not published a binding decision post-DPF, which is the open question other regulators are watching.

The pattern across countries

The Netherlands and Germany are the two large EU markets without a published binding GA4 decision. Both DPAs have issued conservative guidance consistent with the Austrian / French / Italian findings, but neither has produced the case-numbered decision that operators can point to in a contractual document. The DPF adoption in July 2023 changed the calculus: regulators that had not yet ruled now wait to see whether Schrems III invalidates the framework, then update their position.

Digital Omnibus and EU AI Act Overlap with Analytics

The two regulatory updates that move the goalposts through 2026-2027 are the Digital Omnibus proposal (Nov 19, 2025) and the EU AI Act (in force Aug 1, 2024). Both touch analytics in non-obvious ways.

Digital Omnibus — what it changes for analytics

The Commission's Digital Omnibus proposal [5] bundles targeted amendments to GDPR, ePrivacy Directive, Data Act, AI Act, and Cyber Resilience Act. The analytics-relevant pieces:

The Omnibus is a proposal, not law. It enters the ordinary legislative procedure in 2026 with target adoption in late 2026 to mid 2027. The political risk is real — privacy NGOs including NOYB and EDRi have publicly opposed parts of the Omnibus as a "deregulation" effort, and the European Parliament will likely tighten some provisions before final adoption. The realistic operator stance: track the Omnibus, do not bet on it. Plan as if the current rules (CNIL exemption, EDPB Guidelines 2/2023) continue to govern through 2026.

EU AI Act — the overlap that catches most analytics teams

The EU AI Act [6] entered force on August 1, 2024. The phased applicability:

Pure analytics — counting page views, tracking sessions, computing aggregate metrics — is out of scope. Analytics that crosses into AI territory is in scope. The boundary cases:

Most SMB analytics will not hit the high-risk threshold. The teams most likely to be affected are mid-market and enterprise vendors that have layered ML-driven personalization, churn prediction, or behavioral scoring on top of analytics, especially where the scores feed downstream decisions about access, pricing, or insurance. The General Purpose AI Code of Practice published in July 2025 provides operational guidance for the GPAI obligations that took effect August 2, 2025; that text is the right starting point if your analytics stack ingests data into a GPAI model.

Article 22 GDPR overlap with the AI Act

GDPR Article 22 has prohibited "solely automated decision-making with legal or similarly significant effects" since 2018. The AI Act adds a parallel regime with broader scope and higher penalties. Analytics tools that contribute to automated decisions — even indirectly — should treat both regimes as live.

The overlap is not redundancy — they cover different angles of the same problem. An analytics tool that profiles visitors for personalization needs to comply with Article 22 if the profiling feeds significant decisions, and with the AI Act if the profiling system meets the AI Act definition. The conservative engineering posture: keep analytics-as-counting separate from analytics-as-decision-input, with a clean boundary that lets you reason about both regimes independently.

Compliance Comparison: 8 Analytics Tools Side by Side

The compliance grid is what procurement teams actually paste into vendor checklists. The grid below is sourced from each vendor's public data policy or privacy documentation, with the citation appended.

Three things in the grid worth flagging.

First, the "Banner-free in EU?" column. Only the cookieless A1 architectures (Plausible, Fathom, Pirsch, Simple Analytics, Attrifast) get a clean "Yes." Matomo gets a "Conditional" because it depends on whether the deployment uses the cookie-based or cookieless mode. PostHog defaults to cookie-based and therefore needs a banner unless explicitly reconfigured. GA4 + Consent Mode v2 needs a banner regardless of how the consent flow is designed.

Second, the "Schrems II posture" column. The tools that genuinely avoid the Schrems issue are the ones that do not transfer data to US-controlled infrastructure. EU-incorporated vendors (Plausible based in Estonia, Pirsch in Germany, Simple Analytics in the Netherlands) avoid it structurally. Self-hosted Matomo avoids it by giving the operator full control. GA4 with DPF reliance is exposed if the DPF gets invalidated. PostHog EU Cloud and Fathom EU residency mitigate but do not entirely eliminate the issue because the parent company is US-based even when the data sits in the EU.

Third, the "Stripe-native?" column. This is the gap Attrifast was built to close. Most cookieless tools count uniques and sessions; none of them join to revenue without manual webhook plumbing. The revenue join is what turns "GDPR-compliant analytics" into "GDPR-compliant attribution" — and attribution is what most SMB SaaS founders actually need to make budget decisions.

For the deeper comparison on the architecture trade-offs, the longer breakdown is in cookieless tracking solutions and the per-vendor walk-throughs live at vs Google Analytics, vs Plausible, vs Fathom, and vs Pirsch.

Migrating from GA4 to Compliant Analytics — A 5-Step Plan

The migration is mostly a project-management exercise. The technical work is shorter than the political work, which is shorter than the data-reconciliation work.

Step 1: Inventory current GA4 usage

Before changing anything, list every place GA4 data is consumed downstream. The typical inventory:

Most teams underestimate the inventory. The marketing dashboard is obvious; the executive KPI deck is the political one because the CFO's quarterly numbers cannot move without a parallel-validation period.

Step 2: Pick the architecture and the vendor

Use the decision tree from section 4. For most SMB SaaS the answer is approach 2 (cookieless first-party). Pick the specific vendor based on three operational criteria:

The combination of "cookieless + EU residency + Stripe-native" narrows the field. Plausible, Fathom, Pirsch handle the first two. Attrifast handles all three. Matomo handles all three if you self-host. The choice between managed and self-hosted is usually an operational-burden question, not a compliance question.

Step 3: Run parallel for 30-60 days

Do not flip GA4 off when the new tool goes live. Run both in parallel for a full sales cycle plus one (so 30-60 days for most SaaS, longer for enterprise). The parallel period serves three purposes:

The acceptable variance is usually 5-15% on total sessions and 10-20% on attributed channels, with the new tool typically catching more (cookieless tools see the consent-refused traffic that GA4 misses or models). When the variance is in the new tool's favor and the qualitative story matches, the parallel period is succeeding.

Step 4: Migrate downstream consumers

Once the new tool is validated, migrate each downstream consumer from the inventory. The order matters: start with the lowest-stakes consumer (internal dashboard) and end with the highest-stakes (CFO's KPI deck). Each migration is a small project with stakeholder sign-off.

Step 5 (below) handles the GA4 shutdown after all consumers are migrated.

Step 5: Sunset GA4

The sunset has three pieces: data export, account closure, and documentation. The data export is the one teams forget — GA4 raw events are exportable to BigQuery up to the closure date; after that the historical data is gone. The account closure is the legal trigger that ends the US data transfer. The documentation is the artifact procurement teams will ask for in subsequent vendor questionnaires.

The total project timeline is typically 90-120 days for a mid-sized SaaS, longer if the executive KPI deck reconciliation is contested. The technical migration itself is a week of engineering work; the rest is project management, validation, and stakeholder trust.

Consent Rate Benchmarks by Country

The 40-55% median EU consent rate is the headline number. The country-level distribution is what determines whether your specific traffic mix can survive a banner-based approach.

The dispersion matters. A US-heavy site with 5% EU traffic that loses 60% of its EU consent is losing 3% of total signal — Consent Mode v2's modeled fallback can probably fill that. A site with 40% EU traffic that loses 50% of EU consent is losing 20% of total signal, which Consent Mode v2's modeling cannot reliably reconstruct.

The implication for vendor choice:

The "data quality" argument for cookieless is independent of the legal argument. Even if a site's lawyer is confident GA4 + DPF + CMv2 is defensible, the 12-25% signal loss on a 25-50% EU traffic mix is a real business cost. Cookieless analytics with no banner sees the full traffic and gives the marketing team the numbers they actually need to make decisions.

Common GDPR Analytics Mistakes (Field Notes)

The migration audits I run usually find the same five mistakes. Listed in the order of frequency I see them.

Mistake 1: Treating "cookieless" as a marketing word

Several vendors market "cookieless" while storing a session ID in localStorage. Legally, EDPB Guidelines 2/2023 treats localStorage the same as cookies under Article 5(3). Operationally, the vendor's claim to be "banner-free" is false in the EU. Check the vendor's data policy for the exact wording on client-side storage. If the document is vague, run the site through your browser dev tools and check what gets written to Application > Storage.

Mistake 2: Server-side GTM as a Schrems II fix

sGTM is a useful operational improvement. It is not a residency fix. The data still terminates at Google US infrastructure unless the entire collection pipeline is replaced. The Austrian DSB's reasoning applied to the data's final destination, not its routing path. A proxy adds a hop; it does not change the destination.

Mistake 3: Consent banner dark patterns

The CNIL's 2023 cookie sweep and the EDPB's 2022 guidelines on deceptive design patterns specifically targeted "reject" buttons hidden behind multiple clicks, pre-checked boxes, color contrast manipulation, and timing tricks. Inflated apparent consent rates from dark patterns draw active DPA enforcement. The compliance bar is now "equal effort to accept and reject."

Mistake 4: Skipping the Transfer Impact Assessment

Schrems II created an obligation to assess every international transfer for the level of protection in the destination country. Many operators using GA4 + DPF rely on the DPF as if no TIA were needed. The DPF is an adequacy decision for certified US recipients, but the EDPB's Recommendations 01/2020 on supplementary measures still expect the operator to document the assessment. If the DPF gets invalidated, the absence of a TIA leaves the operator without a documented fallback. The TIA itself is a 10-30 page document depending on scope; templates from the IAPP and major law firms are widely available.

Mistake 5: Missing the DPIA when analytics feeds personalization

GDPR Article 35 requires a Data Protection Impact Assessment when processing is "likely to result in a high risk to the rights and freedoms of natural persons." Analytics that feeds personalization, individual-level scoring, or automated decisions almost always meets the threshold. Most operators run a DPIA for the personalization tool but not for the analytics tool feeding it. The right boundary: if your analytics produces individual-level outputs that are consumed by another system, the analytics tool is part of the high-risk processing and needs a DPIA.

Fine Amounts and Enforcement Reality

The GDPR Enforcement Tracker (maintained by CMS Hasche Sigle) is the most-cited public dataset for GDPR fines [11]. The analytics-adjacent fine distribution through Q1 2026:

The Italian Garante's EUR 2 million-range fines against operators combining analytics with unconsented profiling are the cases most worth knowing. The fine itself is not the largest concern for most SMBs; the operational disruption from a compliance order with a 30-day deadline is bigger, and the reputational and procurement impact from being named in a published DPA decision is biggest of all.

The headline EUR 20 million / 4% global turnover cap applies only to severe systemic breaches under GDPR Article 83(5). Analytics-only cases almost never hit that ceiling. The realistic operator stance: budget for the EUR 10K - 250K range as the relevant risk magnitude, plan for the EUR 1M outlier, and treat the EUR 20M cap as a theoretical maximum that drives lawyer behavior more than operator economics.

Procurement deal loss is the underrated risk. It does not show up in the GDPR fine database. It shows up in win/loss reviews as "lost on privacy / vendor risk." European enterprise buyers in healthcare, finance, public sector, and education routinely fail US analytics tools at the vendor questionnaire stage. The cost is the deal, not the fine.

NOYB, Cookiebot, OneTrust, and the Consent Industry

The CMP industry sits between the DPAs and the operators and shapes most of what actually ships. The three names worth knowing:

NOYB has filed thousands of complaints against operators using non-compliant cookie banners, dark patterns, and standard GA Universal / GA4 deployments. Their pattern is to file in volume to force DPA decisions that then become EU-wide precedent. The Schrems II and (in progress) Schrems III cases are the high-profile examples; the 2023-2024 wave of CMP complaints is the operational example.

Cookiebot's annual benchmarks [9] and OneTrust's research [26] are the two most-cited sources for consent rate numbers. Both have an obvious commercial interest (they sell CMPs) but their methodology is publicly documented and the numbers are the best available baseline.

IAB Europe's TCF v2.2 [27] is the technical framework most CMPs implement. The framework has been the subject of its own enforcement — the Belgian APD ruled in February 2022 that the TCF v2.0 architecture itself violated GDPR; IAB Europe revised the framework to v2.2 in 2023 to address the findings. TCF compliance is necessary but not sufficient for a compliant banner.

What Attrifast Ships, and What It Does Not

For full disclosure on the vendor I built: Attrifast ships approach 2 (cookieless first-party) with the Stripe revenue join as the differentiating feature. The architectural specifics:

What Attrifast does not do: cross-device stitching without an authenticated user ID, session replay, A/B testing, feature flags, product analytics (cohort funnels, retention curves at individual user level). Those are different product categories with different privacy trade-offs. Attrifast is purpose-built for "attribute the click to the revenue, cookieless, EU-residency-capable." For sites that need the broader feature set, PostHog EU or Matomo with the Stripe plugin are reasonable choices that pair with Attrifast or substitute for it.

The pieces I am willing to claim with confidence: the data architecture is the same A1 server-side first-party hash pattern Plausible and Fathom document publicly; the EU residency option keeps data inside the EEA; the Stripe webhook join is server-to-server with no client-side identifier required. The pieces I cannot claim without qualification: that Attrifast is "the most compliant" or "100% GDPR-safe" — those phrases are marketing claims, not engineering claims, and the honest version is "architecturally avoids the consent and residency issues other tools rely on workarounds for, while being subject to the same general GDPR obligations as any other EU-operating analytics tool."

For the longer comparison versus the cookieless category, the per-vendor breakdowns live at vs Plausible, vs Fathom, and vs Pirsch. For the comparison versus GA4 specifically, the head-to-head is at vs Google Analytics.

What Changes If Schrems III Invalidates the DPF

The Schrems III case is not decided. Speculating about its outcome is exactly the kind of overconfident analysis that makes operators ignore real legal advice. The disciplined version is to model the two main outcomes and prepare for each.

The pattern from Safe Harbor (invalidated 2015) and Privacy Shield (invalidated 2020) is informative: each lasted four to fifteen years before invalidation, each was replaced by an instrument the court was already known to consider inadequate, and each invalidation triggered a 12-24 month operational scramble for affected companies. If the DPF follows the same pattern, operators who built EU-native analytics architectures during the DPF's validity window will have already done the work the invalidation would otherwise force.

The conservative operator stance for 2026:

1. Treat the DPF as legally valid today, plan for it not being valid in 2027.
2. Run parallel deployments for EU-heavy traffic regardless of legal posture.
3. Document the Transfer Impact Assessment thoroughly so a sudden DPF invalidation does not leave you undefended.
4. Update vendor questionnaires to reflect cookieless / EU-native posture, both as a procurement signal and as forward risk hedging.
5. Keep current EDPB guidance and DPA rulings tracked; they are the operational rules whatever the DPF status.

FAQ

Is Google Analytics 4 GDPR-compliant in 2026?

Not by default. GA4 still transfers personal data to Google servers in the United States. The EU-US Data Privacy Framework adopted in July 2023 papers over Schrems II without addressing its core problem — US surveillance law (FISA 702, EO 12333) still allows US intelligence agencies to compel disclosure of EU resident data held by US providers. Six EU DPAs (France, Austria, Italy, Denmark, Norway, Finland) have already issued adverse findings against standard GA4 deployments [4][13][14][15][16][17][18].

What is the Digital Omnibus and how does it change analytics rules?

The European Commission published the Digital Omnibus proposal on November 19, 2025 [5], bundling targeted amendments to GDPR, the ePrivacy Directive, the Data Act, the AI Act, and the Cyber Resilience Act. The analytics-relevant pieces are a proposed expansion of the audience-measurement exemption in ePrivacy Article 5(3), a clarification that aggregate first-party analytics processed solely by the website operator should not require consent, and tighter rules on automated decision-making that touch analytics-driven personalization. The proposal is in the ordinary legislative procedure with a target adoption window of late 2026 to mid 2027. It does not yet have force of law.

Do I need a cookie banner if I use Plausible, Fathom, or Pirsch?

In most EU jurisdictions, no — provided the deployment meets the CNIL audience-measurement exemption criteria [10]. The four conditions are a rotating salt that breaks cross-session linkage within 24 hours, truncated IP storage, strict purpose limitation to audience measurement only, and no data sharing with third parties. Plausible [20], Fathom [21], Pirsch [22], and Simple Analytics [23] all publish data policies that meet these conditions.

What does Schrems II mean for analytics in practice?

Schrems II is the July 2020 CJEU ruling (Case C-311/18) that invalidated the EU-US Privacy Shield because US surveillance law does not provide EU residents with rights equivalent to GDPR Article 47 [1]. The practical consequence for analytics is that any personal data transferred to a US-based controller falls under heightened scrutiny — Standard Contractual Clauses alone are not sufficient unless supplemented by "additional safeguards" that effectively prevent US intelligence access.

What is the CNIL audience-measurement exemption?

Published by the French data protection authority (CNIL) in 2020 and refined through 2024 guidance [10], the exemption allows analytics that meets four conditions to operate without a consent banner under the ePrivacy Article 5(3) regime: rotating salt or equivalent mechanism, IP truncation, strict purpose limitation to internal audience measurement, and no transmission of the personal data to third parties for any purpose. The exemption is binding in France and persuasive in other EDPB jurisdictions.

How does the EU AI Act affect analytics tools in 2026?

The EU AI Act entered force on August 1, 2024 [6] with phased applicability. Pure aggregate analytics is out of scope. Analytics tools that build behavioral profiles, score visitors for ad targeting, predict churn at the individual level, or feed machine-learning models that influence decisions about EU residents land in a grey zone — particularly where the analytics overlaps with GDPR Article 22 (automated decision-making). The General Purpose AI Code of Practice published in July 2025 provides operational guidance for the GPAI obligations that took effect August 2, 2025.

Which EU country has the strictest analytics enforcement?

By volume of adverse rulings against standard GA4 deployments, France (CNIL) and Austria (DSB) have been the most active. By severity per ruling, the Italian Garante has issued some of the largest individual fines against analytics-related processing. Germany is a fragmented landscape — 17 state-level data protection authorities plus the federal BfDI — and tends toward stricter interpretations than France on details like cookie consent walls.

What is the EU-US Data Privacy Framework and is it actually safe to use?

The EU-US Data Privacy Framework (DPF) is the adequacy decision adopted by the European Commission on July 10, 2023 [2], replacing the invalidated Privacy Shield. NOYB filed challenges within months of adoption arguing that the DPF does not address the FISA 702 and EO 12333 surveillance powers that caused Schrems II [3]. The case is widely referred to as "Schrems III" and is expected to reach the CJEU on the same timeline pattern as the previous two challenges.

What are typical fine amounts for GDPR analytics violations?

The GDPR Enforcement Tracker [4][11] catalogues fines by category. Analytics-related actions cluster in three bands: warnings and compliance orders with no monetary penalty, fines of EUR 10,000 to EUR 250,000 for smaller violations, and large multi-million-euro fines for systemic violations or where analytics is bundled with broader processing failures.

Can I run server-side Google Analytics to fix the Schrems issue?

Server-side GTM (sGTM) proxies the client-to-Google traffic through your own EU-hosted server. It does not change where the data ultimately lands. Google still ingests, stores, and processes the data on Google infrastructure under US jurisdiction. sGTM can help with point-in-time IP redaction, custom parameter scrubbing, and consent enforcement before the event reaches Google. It is a useful operational improvement, not an architectural fix.

What does cookieless analytics actually mean from a GDPR perspective?

From a GDPR perspective, "cookieless" means no persistent client-side identifier. The EDPB's Guidelines 2/2023 on the technical scope of ePrivacy Article 5(3) [7] made explicit that localStorage and fingerprinting fall under the same consent regime as cookies. True cookieless architectures avoid Article 5(3) entirely by not writing to the device. They still need to satisfy GDPR's broader requirements around lawful basis, data minimization, and (for international transfers) the Schrems II rules.

What is a realistic consent rate for cookie banners in the EU?

Cookiebot's annual benchmarks through 2024 [9] reported median consent rates of 40-55% across EU traffic, with significant variance by country. Germany sits around 30-40%, Italy around 50-60%, Nordic countries 35-45%. The CNIL's 2023 cookie sweep found a substantial share of banners non-compliant on at least one criterion.

What is the difference between ePrivacy and GDPR for analytics?

ePrivacy Directive 2002/58/EC Article 5(3) governs the act of storing or accessing information on a user's device — the cookie or storage question. GDPR governs the subsequent processing of personal data. ePrivacy is the gate; GDPR is the post-gate regime. Both apply simultaneously. The ePrivacy Regulation, intended to replace the Directive, has been stalled in EU trilogue since 2017 [12].

Should I migrate off GA4 in 2026?

If your EU traffic is over 25-30% of total sessions, your sales cycle exceeds 7 days, and your business depends on accurate first-party attribution to revenue, the data-quality case for migrating is compelling regardless of the legal angle. If your EU exposure is small and you have documented contractual safeguards under the DPF, the immediate legal risk of staying on GA4 is real but low. The forward-looking risk is that a Schrems III invalidation in 2026-2027 forces a migration on a regulatory timeline rather than a planned one.

Is Attrifast actually GDPR-compliant?

Attrifast ships approach 2 (cookieless first-party) with EU residency option, rotating daily salt, IP truncation, no client-side storage, and no third-party data sharing. The architecture is designed to satisfy the CNIL audience-measurement exemption and to avoid the Schrems II transfer issue by keeping data in the EU. Like any analytics tool, GDPR compliance also depends on the operator's own lawful basis, retention policies, and DPIA process — the tool removes the architectural risks; the operator handles the remaining process obligations. The product details are at /features/privacy-first-analytics and the longer comparison versus the alternatives is at cookieless tracking solutions.

Sources

1. CJEU Case C-311/18 (Schrems II), judgment of 16 July 2020. curia.europa.eu
2. EU Commission Implementing Decision (EU) 2023/1795 on the adequacy of the EU-US Data Privacy Framework, 10 July 2023. eur-lex.europa.eu
3. NOYB challenge to the EU-US Data Privacy Framework, filed September 2023. noyb.eu
4. GDPR Enforcement Tracker, CMS Hasche Sigle. enforcementtracker.com
5. European Commission Digital Omnibus proposal, COM(2025), 19 November 2025. digital-strategy.ec.europa.eu
6. Regulation (EU) 2024/1689 (EU AI Act), in force 1 August 2024. eur-lex.europa.eu
7. EDPB Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, adopted 14 November 2023. edpb.europa.eu
8. Google Ads Consent Mode v2 requirement for EEA, effective 6 March 2024. support.google.com
9. Cookiebot (Usercentrics) annual consent benchmark reports. cookiebot.com
10. CNIL audience-measurement exemption guidance. cnil.fr
11. GDPR Enforcement Tracker, analytics-category fines. enforcementtracker.com
12. EU ePrivacy Regulation proposal status, Council documents. data.consilium.europa.eu
13. Austrian DSB decision DSB-D213.679/0001-DSB/2021, 12 January 2022. NOYB case summary: noyb.eu
14. CNIL Google Analytics formal notice, 10 February 2022. cnil.fr
15. Italian Garante decision Provvedimento 9782890, Caffeina Media srl, 23 June 2022. garanteprivacy.it
16. Danish Datatilsynet guidance on Google Analytics, September 2022. datatilsynet.dk
17. Norwegian Datatilsynet advisory on Google Analytics, June 2023. datatilsynet.no
18. Finnish Tietosuojavaltuutettu decision on Yle's use of Google Analytics, December 2023. tietosuoja.fi
19. Google Consent Mode v2 developer documentation. developers.google.com
20. Plausible Analytics data policy. plausible.io/data-policy
21. Fathom Analytics data and privacy. usefathom.com/data
22. Pirsch Analytics privacy documentation. pirsch.io/privacy
23. Simple Analytics privacy statement. simpleanalytics.com/privacy
24. Matomo GDPR analytics documentation. matomo.org/gdpr-analytics/
25. PostHog cookieless tracking documentation. posthog.com/docs/privacy/cookieless-tracking
26. OneTrust privacy management research. onetrust.com/resources/
27. IAB Europe Transparency and Consent Framework v2.2. iabeurope.eu/tcf-2-2/
28. EDPB Recommendations 01/2020 on supplementary measures (post-Schrems II). edpb.europa.eu
29. Belgian APD ruling on IAB Europe TCF v2.0, February 2022. autoriteprotectiondonnees.be
30. EU AI Act General Purpose AI Code of Practice, published July 2025. digital-strategy.ec.europa.eu

GA4 was built for an internet that does not legally exist anymore. The migration off it is a project, not an emergency — unless you wait for Schrems III, in which case it becomes both. See what cookieless, Stripe-native, EU-residency-capable analytics looks like in Attrifast → Start free trial