Google Analytics banned in several EU countries for violating GDPR, will the same apply to Canada?

        Is Google Analytics a privacy concern, especially considering the current grey zone for EU-US data transfers?  Given EU's moves against Google Analytics, this may be the case. 

        When a European website uses Google Analytics using Google's cookies, the data collected by the Google Analytics cookie transfers all the collected data from the EU to Google's servers in the US. This type of data transfer was ruled by an Austrian court to be breaching the EU's General Data Protection Regulation (GDPR) because the data was not properly protected against access by US intelligence agencies (which is a similar reason to why the EU-US Privacy Shield was overturned). Although this court ruling only applies in Austria, similar rulings banning the use of Google Analytics by websites operating within said country's borders have happened throughout this past year in multiple other EU countries, such as France, Italy, and more recently Denmark. 

        The potential impact of this type of court ruling against Google Analytics is massive, as an estimated 28 million websites worldwide use Google Analytics. Google is attempting to improve its privacy protections by removing third party cookies, similar to how Safari, Firefox, and Brave have already restricted for years. However, removing third party cookies does not remove the Google Analytics problem because those are Google's cookies, not third-party cookies. Moreover, the main reason EU Courts ruled Google Analytics as violating the GDPR was due to Google not protecting the transferred data from access by US intelligence agencies. 

        Currently, this problem is likely to remain until a new privacy framework is built and agreed upon to replace the Privacy Shield framework that was overturned. President Biden has recently signed an order to implement a new EU-US data privacy framework, but this will likely take over 6 months of approval processes. This framework does include new safeguards on US intelligence gathering, limiting it to only what is necessary and proportionate as well as creating a system of redress. Until this is finalized, Google Analytics will likely remain in hot waters with users under GDPR protection. 

        Regarding Canada, although Canada is not part of the GDPR, it is unknown if Canada will follow suit and prevent the use of Google Analytics. Canadian privacy laws are less strict than the GDPR on protecting user data from access by intelligence agencies, and Canada is not under GDPR protection. Although there are clear principles regarding limiting the collection of data to the stated purpose, as well as principles of consent, necessity, and proportionality, these largely apply to Private-Sector organizations rather than government intelligence agencies. Therefore, as long as companies comply with PIPEDA and present a privacy policy detailing the collection of data by Google Analytics cookies, those companies will likely not be in violation of Canadian privacy law. This leaves the issue of US agencies accessing that data under lawful authority in a grey zone.