Schrems II and analytics transfers
Schrems II is the 2020 Court of Justice of the EU judgment that invalidated the EU-US Privacy Shield and held that Standard Contractual Clauses remain valid only with a case-by-case assessment of the destination country's surveillance laws. Its reasoning later drove regulator decisions against certain US-hosted analytics. This page explains the ruling and its analytics impact.
What the court decided
In July 2020, the CJEU ruled in Case C-311/18 (Schrems II) that the Privacy Shield adequacy decision was invalid, because US surveillance law did not provide EU individuals with protections essentially equivalent to EU law and lacked adequate redress. It upheld SCCs in principle but stressed that exporters must verify, case by case, whether the destination country undermines them — and add supplementary measures where it does.
The judgment shifted responsibility onto data exporters to actively assess each transfer.
Impact on analytics
Following Schrems II, several European data protection authorities found specific deployments of US-hosted analytics unlawful where data could be exposed to US authorities and supplementary measures were inadequate. That accelerated interest in EU-hosted, first-party, and proxied measurement. The later EU-US Data Privacy Framework created a new adequacy route, but the assessment discipline Schrems II introduced remains relevant.
- Privacy Shield invalidated; SCCs conditionally upheld
- Exporters must assess each transfer and add safeguards
- Drove EU regulator scrutiny of US-hosted analytics
How it appears in analytics and logs
A history of regulator actions against US-hosted analytics traces to Schrems II: SCCs alone were judged insufficient without effective supplementary safeguards.
Diagnostic use case
Understand why transferring EU analytics data to the US now requires a transfer assessment and possibly supplementary measures, not just a signed contract.
What WebmasterID can help detect
First-party, regional measurement minimises the cross-border transfers that Schrems II made harder to justify.
Common mistakes
- Thinking signing SCCs alone satisfies Schrems II.
- Assuming the DPF erased the need to assess transfers.
- Overlooking supplementary measures for at-risk transfers.
Privacy and accuracy notes
This page is educational and not legal advice. The transfer landscape has since evolved with the Data Privacy Framework; assess current law for any specific transfer.
Related pages
- Standard contractual clauses (SCCs)
Standard Contractual Clauses (SCCs) are model data-protection contract terms adopted by the European Commission that provide a lawful basis for transferring personal data outside the EEA to countries without an adequacy decision. They are commonly used when analytics data flows to vendors abroad. This page explains their role and the assessment that accompanies them.
- EU-US Data Privacy Framework
The EU-US Data Privacy Framework (DPF) is the mechanism, underpinned by a 2023 European Commission adequacy decision, that allows personal data to flow from the EU to US companies that self-certify to its principles. It replaced the invalidated Privacy Shield. This page explains how the DPF enables transfers relevant to analytics and why it stays under scrutiny.
- Cross-border data transfers in analytics
The GDPR restricts transfers of personal data outside the EU/EEA unless a valid mechanism applies — an adequacy decision, Standard Contractual Clauses, or another safeguard. Analytics that ships data to servers abroad therefore raises a transfer question, made sharper by case law on access by foreign authorities. Keeping data in-region or minimising it reduces the issue. This is educational, not legal advice.
- Privacy-first analytics
Regional measurement that sidesteps risky transfers.
Sources and verification notes
- CJEU — Judgment in Case C-311/18 (Schrems II)Full text of the Schrems II judgment.
- EDPB — Recommendations 01/2020 on supplementary measuresPost-Schrems II transfer assessment guidance.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.