EU Court Strikes Down the EU-US Privacy Shield

What Changed

On July 16, 2020, the Court of Justice of the European Union struck down the EU-US Privacy Shield, the framework US companies used to receive personal data from Europe.¹ The case, brought by privacy campaigner Max Schrems over Facebook's transfers, is known as Schrems II. The same court had struck down the Privacy Shield's predecessor, Safe Harbour, in 2015.

The court found that US surveillance law didn't give Europeans' data protection essentially equivalent to the EU's. Standard contractual clauses, the other common route for transfers, survived. But companies relying on them have to check whether the destination country's law undermines them and, if it does, add safeguards or stop the transfer.¹

Google Analytics on Trial

The ruling reached marketing through analytics. Privacy group noyb filed complaints against 101 European companies that used Google Analytics or Facebook Connect, and regulators set up a joint task force to handle them.² In January 2022, Austria's data protection authority ruled that a website's use of Google Analytics breached the GDPR, finding Google's contractual and technical measures did nothing to stop US surveillance.³

In February 2022, France's regulator, the CNIL, reached the same conclusion. It ordered a website to comply within a month, if necessary by stopping using Google Analytics or switching to a tool that didn't send data outside the EU.² When Google announced the end of Universal Analytics a month later, it said its replacement, Google Analytics 4, would no longer store IP addresses.⁴

A New Framework, Still Contested

On July 10, 2023, the European Commission adopted an adequacy decision for a new EU-US Data Privacy Framework. Data can now flow to US companies that commit to its privacy obligations without extra safeguards, and a new Data Protection Review Court lets Europeans challenge how US intelligence agencies use their data.⁵

The framework survived its first challenge. In September 2025 the EU's General Court dismissed a case brought by French MP Philippe Latombe, who appealed in October 2025 to the Court of Justice, the court that struck down both earlier frameworks.⁶

Why It Mattered

Schrems II made where data goes a marketing question, not just a legal one. For three years, standard analytics and ad tags carried legal risk in Europe, and regulators named specific tools. The Data Privacy Framework lowered that risk but didn't end it: like the two deals before it, it depends on US law and on the Court of Justice.

A lawful transfer is a separate question from consent. Even when data can go to the US, tracking European visitors still needs their consent under GDPR.