Compliance in a world that keeps changing.

The French Conseil d'État ruled that technical pseudonymisation (replacing direct identifiers with unique codes) does not constitute anonymisation under the GDPR if the remaining attributes (such as age, location, and event timestamps) can still be combined to single out individuals. To be considered legally anonymous, the risk of re-identification must be 'insignificant' and virtually impossible in practice without disproportionate effort.

This ruling has massive implications for web analytics. Many platforms claim that stripping IP addresses or hashing User IDs makes analytics data 'anonymous' and thus exempt from GDPR consent and transfer restrictions. The Conseil d'État confirms that if a visitor's behavioural stream (browser settings, page path sequence, timestamps) can still be singled out, it remains pseudonymised personal data. Legally compliant web tracking must either secure explicit consent or use a strictly non-identifiable, aggregated tracking methodology.

The Swedish Authority for Privacy Protection (IMY) issued updated guidance clarifying that anonymisation functions within U.S. cloud-based web analytics tools, such as IP masking in GA4, do not constitute sufficient supplementary measures for data transfers. IMY emphasised that as long as the provider holds the encryption keys or identifier mappings, the data remains pseudonymised, not anonymised, subjecting it to GDPR chapter 5 transfer rules.

This is a recurring theme with IMY. They are taking a very strict stance following their earlier Tele2/CDON rulings. For web analysts in the Nordics, this means that turning on 'IP Anonymization' in GA4 or routing traffic via a US-hosted server-side GTM isn't a silver bullet. If you want a legally robust setup in Sweden, you must rely on EU-owned and EU-hosted solutions where the vendor is not subject to FISA 702.

The French Data Protection Authority (CNIL) published its criteria for evaluating 'Pay or Consent' cookie walls. The CNIL stated that while offering an ad-free paid alternative in exchange for denying consent is not fundamentally prohibited, the fee must be 'reasonable and proportionate.' Furthermore, analytics cookies used purely for aggregated, non-intrusive audience measurement may be exempt from consent if they meet strict criteria (first-party only, no cross-site tracking).

CNIL remains one of the few European DPAs to provide a pragmatic 'consent exemption' for strictly non-intrusive analytics. However, the caveat is massive: you cannot use this exemption if your tool shares data across domains or builds user profiles. Standard GA4 setups do not qualify. You need a purpose-built, privacy-first tool (like Robin Signals) properly configured to leverage this French exemption.

The UK's Information Commissioner's Office warned that using predictive analytics to segment audiences based on behaviour (e.g., predicting 'high churn' or 'likely to buy') constitutes profiling. The ICO clarified that organisations cannot rely on 'legitimate interest' to feed behavioural analytics into machine learning algorithms. Explicit consent is required.

This is a direct blow to the 'predictive audiences' features that marketing platforms love to sell. The ICO is drawing a hard line: you can measure what happened using legitimate interest (sometimes), but if you use ML to predict what a user *will* do, you cross into profiling. Analysts must ensure consent banners explicitly mention AI profiling if these features are active.

The Danish DPA confirmed that running a server-side tagging container on EU infrastructure is a valid privacy-enhancing technology (PET), but noted it does not negate controller responsibility. If the server-side container simply proxies personal data (like IPs or unique IDs) to a US analytics vendor, the transfer remains unlawful. The data must be demonstrably aggregated or stripped of all unique identifiers before leaving the EU.

A technically sound reading from the Danes. Server-side tracking has been overhyped as an automatic 'compliance fix.' Datatilsynet correctly points out that simply routing data through Frankfurt before sending it to Google in the US doesn't solve the transfer problem if the payload still contains identifiers. You must actively redact data in the server environment.