Where Your Telemetry Lands

On the thirteenth of January the Austrian data protection authority's decision became public, holding that a website's use of Google Analytics did not comply with the transfer rules in the GDPR. On the tenth of February the French authority announced that it had reached the same conclusion and ordered a website operator to bring its use of the tool into line. Two authorities, two member states, four weeks apart.

One decision is a national authority applying the law to the party in front of it, and it binds that party. Two decisions, from different countries, on the same reasoning, arriving within a month of each other, are something else. Both came out of the same set of complaints filed across the European Union after the Court of Justice's judgment in 2020, so more of them are coming, and the pattern is the thing worth reading rather than either individual outcome.

What makes this an engineering subject rather than a legal one is where the finding lands. The decisions ran against the operator of the website that included the tag. Not against a data center, not against a procurement decision anybody debated, but against four lines of script that a front-end developer pasted into a template because the marketing team asked for a dashboard. That is the shortest path from a routine integration to a question about jurisdiction that I know of.

The chain starts with a 2020 judgment. In Schrems II, decided on the sixteenth of July 2020, the Court of Justice struck down the Privacy Shield arrangement and left standard contractual clauses standing, but conditionally: an exporter has to assess whether the destination country's law actually lets the importer honor the clauses, and add measures where it does not. That conditional is the whole subsequent story, because thousands of organizations read the ruling as "the clauses survived" and stopped there.

The identifiers were treated as personal data. The argument that always gets made first is that an analytics identifier is not a name and does not identify anybody. The Austrian authority did not accept it. A per-browser identifier, arriving together with an address and the details a browser volunteers about itself, singles out a person well enough to be personal data, and once it is personal data every transfer rule in the regulation applies to it.

The supplementary measures were not shown to work. The provider had a list of technical and organizational protections and the authority's finding was not that they were absent. It was that it had not been shown how they would prevent access by intelligence services acting under United States law. That is the difficult standard hiding in the whole framework: a measure counts if it makes the access impossible, not if it makes it contractually prohibited or operationally unlikely.

And the liability sat with whoever placed the tag. The party in front of the authority was the website, and the website did not build the tool, host the data or negotiate the surveillance law. It chose an integration. In the language of the regulation the operator is the controller and the exporter, and both of those roles come with obligations that cannot be delegated to the party you are exporting to by using its product.

A third-party script in a page is a request from your user's browser to somebody else's server, carrying whatever the browser sends by default and whatever the script decides to add. Nothing about it passes through your infrastructure. There is no traffic in your logs, no entry in your architecture diagram, no row in a system inventory, and no moment where anyone chose a region. The destination is wherever the vendor's name resolves that day.

Now count them on a page you own. Analytics, error tracking, session replay, a chat widget, a consent manager, a font, a tag manager that can inject more of the same without a deploy. Every one is the same shape as the thing two authorities have now ruled on, and the tag manager is the sharpest case, because it converts "which third parties receive our users' data" into a permission held by whoever has an account on it.

The useful reframing is short. This is not a privacy policy question and it is not a vendor question; it is a question about where data goes, and the answer is currently decided by whoever last edited a template. Data residency has been treated as a database and storage concern for a decade, chosen once at the infrastructure layer and forgotten. The front end has been making the same decision all along, without anyone treating it as a decision.

A security attestation answers a security question. An audit report describes whether controls exist and were operating over a period: access management, change control, encryption, monitoring. That is worth having and it is genuine evidence about competence. It says nothing at all about which legal system can compel the operator of those controls, which is the only question the authorities were asking.

A contract is a promise, not a property of the system. Clauses, a data processing agreement and a commitment to resist unlawful requests are all obligations a company takes on. None of them changes what a court in the company's own jurisdiction can order it to do. The gap between a contractual commitment and a technical impossibility is exactly the gap the supplementary-measures analysis is about, and it is a gap you can only close in the architecture.

And a certification can be withdrawn under you. The clearest illustration is the arrangement the 2020 judgment invalidated. Thousands of organizations held a live certification under it, right up to the day it stopped meaning anything, and none of them had done anything wrong or changed a line of code. A certificate is a statement about a legal arrangement at a point in time, and legal arrangements are exactly the layer that moves.

Region selection is the first thing anyone reaches for and it is the weakest, because a region usually describes where records are stored rather than everything that touches them. Support access, aggregated telemetry, a control plane, a failover target and the vendor's own internal tooling are frequently somewhere else, and none of that is visible in the dropdown. The honest version of the question is not where the data is stored, it is who can read it and from where.

Sub-processor lists are the second, and they are the only artifact in this area that reliably tells you something. A vendor that publishes its sub-processors and commits to notice before changing them is describing a real dependency graph, and reading it is how you discover that your analytics vendor's error tracking sends a copy somewhere you have never assessed. It is also a change you will never see in a release note, because it is not your release.

Then proxying and self-hosting, which are the real controls and the ones with the sharpest edge. Running the collector yourself, or terminating telemetry on infrastructure you operate, genuinely changes who receives the data. Putting a proxy in front of the same destination does not, and the Austrian reasoning is the reason: a measure counts by whether it prevents access, not by whose name is on the request. The version that works is the one where the data stops.

These are national decisions and they are appealable. Two authorities have ruled and neither one has decided the question for the whole Union, or for the next company, or permanently. Reading two decisions as settled law is how organizations end up rebuilding a stack in a direction that turns out to be optional. The right response is to know what you would do, and to know what it costs, before you find out whether you have to.

The ground underneath is being renegotiated. Talks on a successor to the invalidated arrangement have been running since the judgment, and if they produce something it will change the analysis for a lot of these integrations. It has also happened before, twice, and both previous arrangements were struck down. Building for the outcome you would prefer is a bet on a negotiation you are not in.

And the replacement has its own honest costs. Self-hosted collection means you now operate a data store full of behavioral records, which is a security obligation you did not have and a retention decision somebody has to make. Less capable tooling means worse answers to product questions. The framing that treats residency as pure gain is wrong; it is a trade, and it is a better one when the thing traded away is a dependency nobody chose deliberately.

I want to be careful about the scale of the claim. Two authorities, in two countries, applying their own law to two organizations, is not the internet changing. Plenty of teams will read these decisions, conclude that their own regulator has said nothing and their own exposure is low, and be entirely right. The reason to pay attention anyway is not the ruling. It is that the ruling required nobody to have made a mistake: the tag was standard, the vendor was the market leader, the contract was the one everybody signs.

What stays with me is how short the path is. A person on your team pasted a snippet into a template on a Tuesday, and the destination of your users' data is now a property of that paste rather than of anything in your infrastructure. Every diagram you own stops at the edge of your own systems, and the browser does not. Somewhere in a template right now there is a script tag deciding a question nobody in your organization has been asked.