Is Google Analytics Legal in Sweden? IMY's View

The short answer

We configure both in our tracking and analytics work. This is not legal advice; it is what we tell clients before they choose.

What IMY decided and why

The decisions followed complaints filed across Europe after the EU Court of Justice's Schrems II judgment in 2020, which invalidated the previous EU-US transfer arrangement. IMY examined four companies using Google Analytics and found that the data sent to Google in the US, including identifiers that could be combined with other data to single out a person, was personal data, and that the standard contractual clauses and the technical measures the companies had added did not sufficiently protect it against US surveillance law. Two companies received administrative fines; all were ordered to stop using the tool as configured. The core finding was about the transfer, not about analytics as such.

The EU-US data framework

In July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. Companies in the US that certify under it are treated as offering adequate protection, and transfers to them do not need the standard contractual clauses and supplementary measures that IMY found lacking. Google LLC is certified. In practical terms, the specific reason IMY gave for the decisions no longer applies to a transfer covered by the framework. The caveat every careful adviser adds: the previous two arrangements were struck down by the court, the current one has been challenged, and a business that builds its measurement entirely on it should know that the ground could move again.

Consent and configuration

The transfer question was never the only one. Google Analytics sets cookies, which under the Swedish Electronic Communications Act require prior consent, and it processes personal data, which under GDPR requires a legal basis, a processor agreement and transparency. A GA4 setup that would satisfy a careful review looks like this:

• Consent banner with reject as easy as accept, and consent mode configured so that no GA4 request is sent before consent.
• Google's data processing terms accepted in the property's admin, and Google listed as a processor in your privacy policy with the US transfer explained.
• Google Signals off unless you have a specific need, so that data is not linked to signed-in Google accounts for advertising.
• Data retention set only as long as you need, user-level data deletion requests handled, and no personal data such as email addresses sent in URLs or events.
• Ideally server-side tagging in an EU region, so that IP addresses and identifiers can be trimmed before anything reaches Google.

Our GA4 setup guide walks through the configuration side of that list step by step.

Alternatives with EU hosting

The simplest way to avoid the whole discussion is to measure without transferring personal data to the US and, ideally, without cookies. Tools such as Plausible, Matomo, Fathom and Umami can be hosted in the EU or on your own server, count visits without a cookie, and produce reports that cover what most small companies actually look at: visits, pages, sources, countries and a handful of goals. What you give up is Google's audience demographics, the deep integration with Google Ads, and the free price. We compare them in our guide to cookie-free analytics alternatives.

A risk-based decision

When you do not need help with this: a site that already has a compliant banner and no advertising can switch to a cookie-free tool in an afternoon with the tool's own guide. When you do: if you spend on Google Ads and need attribution that satisfies both your marketing and your privacy review, the configuration is fiddly and worth doing once, properly. Book a call with your current setup and we will tell you which of the four cases you are in; the fixed price for a full tracking setup is on the pricing page.

Frequently asked questions