Where Your Telemetry Lands

On the tenth of July the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. The practical effect was immediate and large: a transfer to a United States organization that has self-certified under it stops needing standard contractual clauses and stops needing an assessment of what the destination country's law permits. A week later the certification program opened, and a lot of items that had been sitting open on compliance registers since 2020 were closed.

The eighteen months before that ran the other way. In January 2022 the Austrian data protection authority held that a website's use of Google Analytics did not comply with the transfer rules in the GDPR. The French authority reached the same conclusion four weeks later and ordered an operator to bring its use of the tool into line. The Italian authority followed that summer, and the Swedish one this year. Same complaints, filed across the Union after the Court of Justice's judgment in 2020, same reasoning, four countries.

So inside a year and a half the identical integration was unlawful and then unremarkable, and nothing about the integration changed. No line of code moved. The data still leaves the browser, still lands in the same place, and is still handled by the same company. What changed is an assessment, made in Brussels, of the law that applies once it gets there. That is worth sitting with, because it tells you exactly what kind of fact your compliance position is, and how much of it you control.

What makes this an engineering subject rather than a legal one is where the original findings landed. They ran against the operator of the website that included the tag. Not against a data center, not against a procurement decision anybody debated, but against four lines of script that a front-end developer pasted into a template because the marketing team asked for a dashboard. That is the shortest path from a routine integration to a question about jurisdiction that I know of, and adequacy did not shorten or lengthen it.

The chain starts with a 2020 judgment. In Schrems II, decided on the sixteenth of July 2020, the Court of Justice struck down the Privacy Shield arrangement and left standard contractual clauses standing, but conditionally: an exporter has to assess whether the destination country's law actually lets the importer honor the clauses, and add measures where it does not. That conditional is the whole subsequent story, because thousands of organizations read the ruling as "the clauses survived" and stopped there.

The identifiers were treated as personal data. The argument that always gets made first is that an analytics identifier is not a name and does not identify anybody. The Austrian authority did not accept it. A per-browser identifier, arriving together with an address and the details a browser volunteers about itself, singles out a person well enough to be personal data, and once it is personal data every transfer rule in the regulation applies to it.

The supplementary measures were not shown to work. The provider had a list of technical and organizational protections and the authority's finding was not that they were absent. It was that it had not been shown how they would prevent access by intelligence services acting under United States law. That is the difficult standard hiding in the whole framework: a measure counts if it makes the access impossible, not if it makes it contractually prohibited or operationally unlikely.

And the liability sat with whoever placed the tag. The party in front of the authority was the website, and the website did not build the tool, host the data or negotiate the surveillance law. It chose an integration. In the language of the regulation the operator is the controller and the exporter, and both of those roles come with obligations that cannot be delegated to the party you are exporting to by using its product.

A third-party script in a page is a request from your user's browser to somebody else's server, carrying whatever the browser sends by default and whatever the script decides to add. Nothing about it passes through your infrastructure. There is no traffic in your logs, no entry in your architecture diagram, no row in a system inventory, and no moment where anyone chose a region. The destination is wherever the vendor's name resolves that day.

Now count them on a page you own. Analytics, error tracking, session replay, a chat widget, a consent manager, a font, a tag manager that can inject more of the same without a deploy. Every one is the same shape as the thing two authorities have now ruled on, and the tag manager is the sharpest case, because it converts "which third parties receive our users' data" into a permission held by whoever has an account on it.

The useful reframing is short. This is not a privacy policy question and it is not a vendor question; it is a question about where data goes, and the answer is currently decided by whoever last edited a template. Data residency has been treated as a database and storage concern for a decade, chosen once at the infrastructure layer and forgotten. The front end has been making the same decision all along, without anyone treating it as a decision.

A security attestation answers a security question. An audit report describes whether controls exist and were operating over a period: access management, change control, encryption, monitoring. That is worth having and it is genuine evidence about competence. It says nothing at all about which legal system can compel the operator of those controls, which is the only question the authorities were asking.

A contract is a promise, not a property of the system. Clauses, a data processing agreement and a commitment to resist unlawful requests are all obligations a company takes on. None of them changes what a court in the company's own jurisdiction can order it to do. The gap between a contractual commitment and a technical impossibility is exactly the gap the supplementary-measures analysis is about, and it is a gap you can only close in the architecture.

And this is the third arrangement of its kind in eight years. The first was struck down in 2015 and the second in 2020, and on the morning the second one fell, thousands of organizations held a live certification under it, had done nothing wrong, and had not changed a line of code. The one adopted in July is the third attempt at the same problem, and it rests on an executive order rather than a statute, which is a thinner foundation than it sounds like. It may well hold. My point is that "it may well hold" is the strongest sentence anybody can honestly write about it, and that is a strange thing to put underneath an architecture.

Region selection is the first thing anyone reaches for and it is the weakest, because a region usually describes where records are stored rather than everything that touches them. Support access, aggregated telemetry, a control plane, a failover target and the vendor's own internal tooling are frequently somewhere else, and none of that is visible in the dropdown. The honest version of the question is not where the data is stored, it is who can read it and from where.

Sub-processor lists are the second, and they are the only artifact in this area that reliably tells you something. A vendor that publishes its sub-processors and commits to notice before changing them is describing a real dependency graph, and reading it is how you discover that your analytics vendor's error tracking sends a copy somewhere you have never assessed. It is also a change you will never see in a release note, because it is not your release.

Then proxying and self-hosting, which are the real controls and the ones with the sharpest edge. Running the collector yourself, or terminating telemetry on infrastructure you operate, genuinely changes who receives the data. Putting a proxy in front of the same destination does not, and the Austrian reasoning is the reason: a measure counts by whether it prevents access, not by whose name is on the request. The version that works is the one where the data stops.

Adequacy is narrower than the relief suggests. The decision covers transfers to organizations that have certified under the framework and appear on the list. A recipient that has not certified is exactly where it was in June, needing clauses and an assessment of the destination country's law. Most teams have more of the second kind than the first, and which is which is not visible anywhere in a codebase, a diagram or a dependency file.

A further challenge is expected by the people who brought the last two. The advocacy group behind both previous judgments said on the day the decision was adopted that it expected to be back before the Court of Justice. Whether it succeeds is not something I am qualified to score. What I would note is that the two previous arrangements lasted about five years each and ended the same way, and that nothing in this one dissolves the underlying tension between a surveillance statute and a regulation written to constrain exactly that.

And the replacement has its own honest costs. Self-hosted collection means you now operate a data store full of behavioral records, which is a security obligation you did not have and a retention decision somebody has to make. Less capable tooling means worse answers to product questions. The framing that treats residency as pure gain is wrong; it is a trade, and it is a better one when the thing traded away is a dependency nobody chose deliberately.

A handful of national authorities applying their own law to a handful of organizations was never the internet changing, and an adequacy decision is not the question closing. Plenty of teams will read all of it, conclude that their own regulator has said nothing and their own exposure is low, and be entirely right. The reason to pay attention anyway is that none of it required anybody to have made a mistake: the tag was standard, the vendor was the market leader, the contract was the one everybody signs, and the legal ground moved twice underneath all three.

The path is remarkably short. A person on your team pasted a snippet into a template on a Tuesday, and the destination of your users' data is now a property of that paste rather than of anything in your infrastructure. Every diagram you own stops at the edge of your own systems, and the browser does not. Somewhere in a template right now there is a script tag deciding a question nobody in your organization has been asked.