The Court of Justice of the European Union’s Schrems II judgment (16 July 2020, case C-311/18) invalidated the EU–US Privacy Shield and left Standard Contractual Clauses (SCCs) standing only if you actually assess the destination country’s surveillance law. European Data Protection Board guidance followed. National cases against Google Analytics (Austria, France, Italy, and others) treated GA4 hits as transfers of personal data to Google LLC in the United States.
The market reaction split in two: “move analytics to the EU” and “stop using Google Analytics.” Cookieless vendors got adopted for the second reason as much as the first. Those are different promises.
SiteLine does not market an EU-only hosting region. Events go to SiteLine servers operated by Aglet Technologies. Subprocessors include Stripe (payments) and Cloudflare (transactional email; often DNS, TLS, and abuse protection). Those organisations may process data in the United States, the European Union, Australia, and elsewhere. Where the law requires it, Aglet relies on appropriate safeguards such as SCCs. The cookieless tracker does not change the fact that event payloads leave the browser and land on our infrastructure.
If you need a single-region EU appliance with no US subprocessors, this is the wrong product to stretch. If you need to stop setting a GA cookie and stop sending measurement to Google Analytics, it may be the right one. Policy: /privacy. Model: /docs/privacy. Not legal advice.
What Schrems II actually broke
It broke unchecked “we have Shield, so transfers are fine.” It did not make IP addresses illegal. It did not require a cookie banner by itself — that is ePrivacy. It made exporters (you) document:
- what personal data leaves the EEA/UK
- who the importer is
- which mechanism (SCCs, adequacy, derogation)
- whether supplementary measures are needed
Google Analytics lost a string of DPA cases because the importer was Google, the data included unique identifiers and often full IPs, and the supplementary-measures story did not satisfy those authorities.
Replacing Google with a smaller US-linked SaaS does not automatically win those cases. It does change the data: SiteLine does not set an analytics cookie; visitor ids are daily hashes of truncated IP (IPv4 /24, IPv6 /48) plus user agent; raw IP is not stored on the event; no ads identity, no data sale. That is a different transfer file than GA4 + Google Ads. It is still a transfer file. See IP anonymization vs cookieless analytics and Cookieless tracking explained.
What to write in a transfer assessment
Facts you can copy from the product, not slogans:
- Importer: Aglet Technologies, product SiteLine (siteline.tools). Contact [email protected].
- Categories: page URL, path, hostname, referrer, event name, optional properties, UTMs, derived device/browser/OS, country when available, daily visitor hash. Account data if you have a SiteLine login (name, email, billing via Stripe). Search Console performance data if you connect Google (read-only).
- Not included on the event: raw IP, analytics cookie id, advertising graphs.
- Subprocessors: Stripe; Cloudflare; cloud hosting (region not published as a fixed marketing claim — ask if the assessment needs the current location).
- Retention: analytics while subscribed ($4.99 / $19.99 / $99.99 USD, 7-day trial) plus 30-day grace, then purge; GSC while the account exists.
- App cookies (siteline.tools only): session, CSRF, theme/sidebar.
A first-party proxy (nginx, Caddy, Cloudflare Worker, Vercel rewrites; no managed CNAME in v1) does not localise processing in your VPC. It only changes the hostname the browser calls. If the proxy is Cloudflare, you have added Cloudflare to the path twice — be precise in the diagram.
Adequacy, the Data Privacy Framework, and “we’re fine now”
The EU–US Data Privacy Framework (2023) restored an adequacy path for certified US organisations. It is not a blanket for every SaaS you use. Stripe and Cloudflare publish their own participation and SCCs. Aglet’s policy describes safeguards without pretending the Framework made Schrems a historical curiosity. A future CJEU case can reopen this; we will update /privacy when our practices or the law under our feet change.
UK transfers follow UK GDPR and the UK’s own addenda — similar plot, different paperwork.
Cookieless does not equal “no transfer of personal data”
Hashes can be personal data. URLs can be personal data (/account/reset?email=). Country + device + timestamp can contribute to identifiability. Minimisation is real; “anonymous EU traffic statistics with no importer” is not what SiteLine is.
For the banner question, stay on GDPR analytics without a consent banner. For Australia’s different overseas-disclosure rule, Analytics and the Australian Privacy Act.
FAQ
Does SiteLine offer an EU-only region?
No. Do not write that in a tender. Ask [email protected] for the current hosting location when a transfer assessment needs it.
If we proxy collect through our EU origin, is that an EEA transfer-free setup?
No. The origin forwards the POST to SiteLine. You have added a hop, not deleted the importer. Docs: /docs/proxy.
Is replacing GA4 enough to close a Schrems finding?
It closes the “we send analytics to Google Analytics” finding. You still need a basis, notice, and a transfer mechanism for SiteLine and its subprocessors. Some organisations will still want an EU-hosted self-hosted Matomo. That is a valid different product, not a failure of cookieless hashing.