Schrems III: what happens if the DPF falls?
The Data Privacy Framework made GA4 technically legal again in 2023. Now the framework is being challenged in court, and twice before the same journey has ended in invalidation. Here is what is at stake and how you remove the risk from your web analytics.
The short answer
Schrems III is the ongoing legal challenge to the EU-US Data Privacy Framework, the adequacy decision that today serves as the legal basis for moving personal data from the EU to the US. The argument is the same one that brought down Privacy Shield in 2020: US surveillance law has not changed in substance, so the new framework carries the same legal flaw as the old one. If the DPF falls, every Swedish site sending data to the US, for example via Google Analytics, is back in the 2022 legal situation overnight.
Third time down the same road
The name comes from Max Schrems, the lawyer behind the organization noyb. His two earlier cases against the European Commission's adequacy decisions for the US both won in the Court of Justice of the EU. The pattern is worth seeing in full:
- 2015Schrems I brings down Safe Harbor
The Court of Justice of the EU invalidates the first framework for EU-US transfers.
- Jul 2020Schrems II brings down Privacy Shield
The successor meets the same fate. The US becomes a third country without an adequate level of protection.
- Jul 2023IMY rules against four Swedish companies
CDON, Coop, Dagens Industri and Tele2 are found liable for GA4 transfers to the US. Administrative fines of up to 12 million kr.
- Jul 2023Data Privacy Framework adopted
The European Commission adopts the third framework. GA4 becomes technically legal again, under conditions.
- OngoingSchrems III
A new legal challenge to the DPF. Realistic time horizon for a ruling: a few years.
What the case is about
The core question is whether US intelligence law gives EU citizens protection that is essentially equivalent to the GDPR. The Schrems II judgment said no, because US authorities can demand data from American companies without the judicial review and legal remedies that EU law requires. The DPF tries to solve this with a new redress body, but the criticism is that the underlying legislation is the same. That is the question the court now has to answer again.
What happens if the DPF is invalidated?
- GA4's legal basis disappears. Swedish GA4 installations are then left where IMY's 2023 decisions put them: the transfer violates the GDPR.
- The assessment could be retroactive. Data transferred during the DPF period may come to be regarded as unlawfully processed.
- The transition happens under time pressure. After Schrems II, companies were given no transition period. Anyone who already has an exit plan, or no dependency at all, avoids doing the work in a panic.
Two ways to prepare
Path 1: stay on GA4 with your eyes open. Document the configuration (Consent Mode v2, retention, DPA), follow IMY's guidance and keep a ready plan for which tool you switch to if the DPF falls. We have written a full walkthrough in Is Google Analytics legal in Sweden in 2026?
Path 2: remove the risk entirely. An analytics tool with no third-country transfer is unaffected by the outcome, whichever way it goes. No data leaves the EU, so there is no adequacy decision to lean on and nothing that can fall. That is how Spårlös is built: EU-hosted, cookie-free, with no US sub-processors. How a migration works step by step is covered in Switch from Google Analytics in 2026.
Frequently asked questions
What is Schrems III?
The ongoing legal challenge to the EU-US Data Privacy Framework (DPF), the adequacy decision that currently makes transfers of personal data to the US lawful. The name comes from the lawyer Max Schrems, whose two earlier cases brought down Safe Harbor (Schrems I, 2015) and Privacy Shield (Schrems II, 2020).
When will the ruling come?
There is no fixed date. A realistic time horizon, based on how Schrems I and II played out, is a few years from when the challenge was filed, often estimated at around 2 to 4 years. Follow IMY and noyb for the current status.
Does it affect me if I use Google Analytics?
Yes, directly. The legal basis for GA4’s US transfer rests on the DPF. If the DPF falls, Swedish GA4 users end up back in the 2022 situation, when IMY’s decisions against CDON, Coop, Dagens Industri and Tele2 followed. The assessment could also be applied retroactively.
What should I do already today?
Either document your GA4 configuration properly and keep a ready exit plan, or remove the risk entirely by switching to a tool with no third-country transfer. The switch is easier than it sounds, a standard site migrates in under an hour.
Is Spårlös affected by Schrems III?
No. Spårlös makes no third-country transfer at all: no data leaves the EU, there are no US sub-processors in the data path and no cookies are set. The outcome of Schrems III changes nothing for our customers.
Further reading: Schrems II in practice · How GA4 data flows to the US · Spårlös vs Google Analytics · The IMY situation in one place.