Can I still use Google Analytics on my Italian website in 2026?

Yes, under the current legal framework you aren't in breach of the Garante's 2022 order: that order concerned the lack of a valid legal basis for transferring data to the United States, and since July 10, 2023 that legal basis exists, the EU-US Data Privacy Framework, upheld by European courts in September 2025. It's still a framework in motion, not settled for good: it's worth keeping an eye on in the coming months.

What exactly did the Garante decide in 2022?

On June 9, 2022 the Garante warned a website operator (Caffeina Media S.r.l.) because Google Analytics transferred visitor data to the United States without an adequate legal basis, after the Court of Justice of the European Union had invalidated the Privacy Shield agreement in 2020. It gave ninety days to comply, or it would order the suspension of data flows to the United States, and similar orders followed for other Italian sites in the following months.

Do I still need to show a consent banner for Google Analytics cookies?

In the vast majority of cases yes, and it's a separate question from the data transfer issue. The Garante's cookie guidelines exempt third-party statistical cookies from consent only if the provider doesn't combine the data with other processing or pass it on to other parties, a condition that's hard to document for a provider the size of Google. The cookie banner therefore stays necessary regardless of how the Data Privacy Framework story develops.

Why could the 2023 legal basis change again?

Because it's under attack on two fronts opened between 2025 and 2026. In Europe, a challenge to the adequacy decision is pending before the Court of Justice of the European Union, after the General Court dismissed it in September 2025. In the United States, a Supreme Court ruling of June 29, 2026 weakened the independence of the Federal Trade Commission, one of the premises the agreement relies on, prompting the organization noyb to ask the European Commission for an orderly withdrawal from the framework.

If the Data Privacy Framework were annulled, what would change for my site?

There would again be no direct legal basis for transferring data to the United States through Google Analytics, the same situation the Garante challenged in 2022, unless other measures are adopted in the meantime. That's not a prediction that can be made with certainty today, because it depends on the outcome of a still-pending appeal: one more reason not to treat the matter as settled when reviewing your site's setup.

BlogGuides

Google Analytics and privacy: what changed for an Italian website

25 October 2026

A man wearing glasses reviews and gathers printed sheets of paper at a desk, in an office with a table lamp and light curtains in the background

Add as a preferred source on Google

One click, and Google will show my articles more often in your results.

In 2022 Italy's data protection authority, the Garante, declared the use of Google Analytics unlawful as configured on most Italian websites. It's news that many business owners still remember, and it often turns into a single question whenever Analytics comes up again today: can it still be used or not? The answer has changed at least twice since 2022, and it's back under debate in 2026: here's what can be said with certainty today.

What the Garante decided in 2022

On June 9, 2022 the Garante warned Caffeina Media S.r.l. for the unlawful processing of its website visitors' data, collected through Google Analytics (order no. 9782890, announced on June 23, 2022). The problem wasn't the tool itself, but the transfer of data to the United States: after the Court of Justice of the European Union invalidated the Privacy Shield agreement in 2020 (the Schrems II ruling), there was no valid legal basis for that transfer, and the additional measures Google had adopted weren't enough, in the Garante's view, to guarantee protection equivalent to the European standard. The Garante gave the company ninety days to comply, on pain of suspending data flows to the United States, and similar orders followed for other Italian site operators in the following months (source: Garante per la protezione dei dati personali, order no. 9782890 of June 9, 2022, checked on October 25, 2026).

2023 changes the legal basis

The problem the Garante identified was about the legal basis for the transfer, not the tool as such, and it's exactly that legal basis that changed the following year. On July 10, 2023 the European Commission adopted a new adequacy decision for the United States, the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), which allows personal data to be transferred to US companies certified under the scheme. Google is among the certified companies. From that date on, a site using Google Analytics with a configuration covered by the provider's certification no longer has the specific problem the Garante challenged in 2022 (source: European Commission, Implementing Decision (EU) 2023/1795 of July 10, 2023, checked on October 25, 2026).

The courts have upheld the decision, for now

It didn't stay an unchecked political decision: it was tested in court. On September 3, 2025 the General Court of the European Union dismissed the appeal brought by French member of parliament Philippe Latombe against the adequacy decision, confirming its validity, including the independence safeguards of the redress mechanism set up for European citizens (case T-553/23). Latombe appealed to the Court of Justice of the European Union on October 31, 2025 (case C-703/25 P), and Microsoft was admitted to intervene in the proceedings in support of the Commission. As of this article, the appeal is still pending, with no ruling yet (sources: General Court of the European Union, case T-553/23, September 3, 2025; Court of Justice of the European Union, case C-703/25 P, checked on October 25, 2026).

A new front opened in mid-2026

While the Latombe appeal was still pending, a second front opened on the other side of the Atlantic. On June 29, 2026 the United States Supreme Court, in Trump v. Slaughter, ruled that Federal Trade Commission commissioners no longer have protection against removal at the president's will, overturning a precedent that had stood since 1935. The following day, the privacy organization noyb sent a formal letter to the European Commission, arguing that the ruling undermines one of the premises the adequacy decision rests on, namely the independence of US oversight, and extending the same reasoning to the redress mechanism created for European citizens. noyb asked for an orderly withdrawal from the Data Privacy Framework, warning of a new challenge before the Court of Justice within a few weeks if the Commission doesn't act (source: noyb, letter to the European Commission of June 30, 2026, checked on October 25, 2026).

What this means today for website owners

As of today, October 25, 2026, the adequacy decision remains formally in force: it hasn't been revoked by the Commission or annulled by a court. The European Data Protection Board formally asked the Commission to assess the impact of the US ruling, but neither the Commission nor the Board has so far indicated that use of the framework should be suspended. For anyone running an Italian website, this translates into a concrete situation: using Google Analytics today doesn't breach the 2022 order, because the specific problem from back then has had a valid legal basis since 2023, upheld once in court. But that legal basis is under attack on two fronts at once, and it has already changed twice in under four years: treating it as a permanent fixture would be as much a mistake as still treating the 2022 ban as current.

Consent remains a separate problem

There's a second layer, separate from the data transfer question, that applies to every site regardless of how the Data Privacy Framework story resolves: consent for Google Analytics cookies. The Garante's cookie guidelines (order no. 231 of June 10, 2021) exempt third-party statistical cookies from consent only if three conditions are met together: a significant part of the IP address is masked, the data stays limited to aggregated statistics for that single site, and the provider commits not to combine it with other processing or pass it on to other parties. The third condition is the hardest to document for a provider like Google, which offers dozens of other services: in practice, that's why most Italian sites still ask for consent for Analytics through a cookie banner, regardless of how the transfer question plays out (source: Garante per la protezione dei dati personali, order no. 231 of June 10, 2021, checked on October 25, 2026).

Anyone writing or updating their site's privacy policy will find these two points, the data transfer and cookie consent, among the facts needed before sitting down to write the text: that's where they belong, not in a piece of legal news coverage. If you want to check whether your site is still aligned on these two points, it can be covered inside the digital check-up; otherwise get in touch.