Why did Google Analytics run into GDPR trouble, and what did the ruling require?

Google Analytics transferred personal data (including IP addresses) to US servers without an adequate legal basis; courts ruled that explicit consent is required and that IP anonymization alone is not sufficient.

The core problem — US data transfer:

• Google Analytics sent personal data (IP addresses, etc.) to US servers
• No adequate legal basis for the third-country transfer; insufficient transparency about data flows

GDPR requirements at stake:

• Art. 6 — a lawful basis (consent or legitimate interest)
• Art. 44–49 — guarantees for international transfers
• Art. 12–14 — transparency obligations toward users

The ruling & consequences:

• Explicit consent is required for such transfers
• Users must be informed of the risks of US transfer
• IP anonymization alone is not enough
• Consent management became mandatory for US analytics tools; the EU-US Data Privacy Framework (2023) now governs transfers under strict conditions