A US Supreme Court ruling just put Google Analytics' EU data transfers back in question

By Nikhil Vemu · July 26, 2026 · Updated September 18, 2026

If your website uses Google Analytics and serves visitors in the EU, the legal basis for sending their data to the US just got shakier — again. On 29 June 2026 the US Supreme Court ruled, 6-3, that the President can fire Federal Trade Commission commissioners at will. That sounds like domestic US politics, but it knocks out the exact thing the EU-US Data Privacy Framework — the deal that currently makes GA4's transatlantic data flow legal — leans on to prove US oversight is trustworthy. Austria's noyb (Max Schrems' group, the people who killed the last two of these deals) has already written to Brussels asking it to pull the plug.

Nothing is illegal today. The Data Privacy Framework is still formally in force, no regulator has told anyone to stop, and this is uncertainty, not a ban. But it's the same kind of uncertainty that hung over EU analytics between Schrems II and the current deal — and if you run a tool that never ships your visitors' personal data to the US in the first place, none of it touches you. This post explains what actually changed, why the Framework is exposed, and what switching tools does and doesn't fix.

What the court actually decided

The case is Trump v. Slaughter (No. 25-332). In March 2025 the President removed FTC Commissioner Rebecca Slaughter; the statute said commissioners could only be removed "for inefficiency, neglect of duty, or malfeasance in office." The Court sided with the President and, in doing so, overruled Humphrey's Executor v. United States — a 1935 precedent that had protected the independence of agencies like the FTC for nearly ninety years.

The domestic consequence is that the FTC — and, by the same logic, agencies like the NLRB and MSPB — is no longer structurally independent of the White House. That's the part that reaches across the Atlantic.

Why the Data Privacy Framework is exposed

When the European Commission granted the US "adequacy" in July 2023 (Commission Implementing Decision (EU) 2023/1795, the legal instrument behind the Data Privacy Framework), it had to explain how US law protects EU citizens' data to a standard "essentially equivalent" to the GDPR. A central pillar of that argument was independent oversight and redress — and the FTC's independence is cited throughout the adequacy decision as proof the enforcement is real. noyb counts more than 250 references to it.

Pull the independence out, and noyb's argument is blunt: the factual premise the Commission relied on no longer holds. In their words, "the entire structure of the EU-US Data Privacy Framework has just collapsed." On 30 June 2026 Schrems sent the Commission a formal letter calling for an "orderly withdrawal" from the adequacy decision, and said noyb would file its own annulment case at the Court of Justice of the EU "in the coming weeks" if Brussels doesn't act.

Not everyone thinks the FTC is the load-bearing part. Some privacy lawyers argue the adequacy decision leans harder on the redress route the US built for EU citizens — the Data Protection Review Court, created by executive order — which this ruling leaves untouched, and that the FTC's role is smaller than noyb makes out. That's a real debate, and it's why nobody credible is calling the deal dead today. What isn't in dispute is that a safeguard the Commission cited throughout its decision has just been weakened, at the exact moment the deal's most effective critic is heading back to court.

Two other things worth keeping straight, because they cut against the panic:

• The Framework is still valid. Implementing Decision (EU) 2023/1795 stays in force until the Commission repeals it or the CJEU annuls it. As of today it has done neither, and the Commission has said only that it's assessing the ruling and is "in close contact with the US administration."
• This isn't the same as the pending EU-side challenge. A separate case (Latombe, C-703/25 P) is already working its way up to the CJEU. What's new here is a US-side event — the removal of the safeguard the deal was built on — that hands that kind of challenge fresh ammunition.

So it's not "GA4 is now banned." It's "the mechanism that was supposed to make EU→US transfers safe has a new, serious crack in it, and the people who broke the last two frameworks are back in court."

What this means if you use Google Analytics

Google LLC self-certifies under the Data Privacy Framework (its listing is active), and it relies on that certification — with Standard Contractual Clauses as a backstop — to legitimize moving EEA personal data to the United States. That's the plumbing under GA4 for European sites: your visitors' data goes to Google in the US, and the DPF is a big part of what makes that lawful.

If the DPF's foundation is genuinely in doubt, so is that transfer story. And the backstop is not obviously safer: Standard Contractual Clauses require a "transfer impact assessment" that weighs whether US oversight bodies actually protect the data — an assessment that, until last month, took the FTC's independence as a given. The same ruling that dents the DPF dents the fallback.

None of this forces an immediate change. But it is exactly the sort of live legal risk that made EU regulators uneasy about Google Analytics after Schrems II — and it's worth knowing whether your analytics even puts you in the blast radius.

What actually helps

Collecting less helps, but it doesn't make a product immune to EU transfer rules: who can access the data, from where and in what role matters too, not only server location. Truly anonymous information falls outside the GDPR, but a short-lived pseudonymous identifier is not automatically anonymous, as the EDPB's explanation of pseudonymisation makes explicit.

Simplytics sets no visitor cookies and does not store raw IP addresses in its analytics database. It does temporarily store a keyed daily hash of a truncated IP, user-agent, domain and site-local date, which links same-day visits on one site. Raw visit rows are deleted nightly, but retained aggregates can still contain identifying page paths or event names.

The primary analytics database is hosted in Warsaw, the service is administered from India, and Cloudflare is a US-headquartered provider.

What Simplytics offers is technical: no visitor cookies, no ad-network integration, a small script, short raw-data retention and an EU-hosted primary database.

What to actually do

1. Map the real data flow. List every provider and person with access, what each receives, and where each is located.
2. Check the legal route. If personal data goes to a third country, check whether an adequacy decision or appropriate safeguard covers that recipient and processing. Consent for device access is a separate question.
3. Keep your notice accurate. Describe the identifiers and fields you actually collect, including identifying paths or event names. If you change analytics providers or transfer historical reports to a new controller, revisit purposes, notices and retention.

The conclusion: the FTC ruling raises a question about the Data Privacy Framework worth watching. A cookieless tool can reduce data collection, but it does not automatically take a website outside privacy or transfer law; have a qualified adviser review your setup before relying on an exemption or treating a transfer question as resolved.