May I still use Google Analytics?

Google Analytics + GDPR has a tumultuous history: 2020 Schrems II (Privacy Shield invalid), 2022-2023 Austria/France/Italy fining GA users, 2023 EU-US Data Privacy Framework. 2026 status: GA is usable under strict conditions. Required configuration: (1) Consent Mode v2 (mandatory for EU traffic since March 2024). GA loads conditional on consent — on "Reject" only anonymous modelling pings. (2) IP anonymisation (Google processes shared in storage anyway, but IP masking reduces risk). (3) DPA via Google Workspace / Cloud account — automatic in standard contracts. (4) Data Privacy Framework as transfer basis for data to Google USA. (5) Privacy statement mentions GA use + your rights. What is STILL risk: if Schrems III against Data Privacy Framework succeeds (NOYB has challenged, ruling expected 2026-2027), GA use can immediately become unlawful again. Privacy-friendly alternatives: Matomo (self-hosted or EU cloud), Plausible (open-source EU), Fathom Analytics. No consent banner needed — all data in EU. Trade-off: less feature-rich than GA. For consumer: ad-blocker (uBlock Origin) blocks GA + Consent Mode v2 pings by default — no tracking.