> <i>According to the data protection regulation, GDPR, personal data may be transferred to third countries, i.e. countries outside the EU/EEA, if the European Commission has decided that the country in question has an adequate level of protection for personal data that corresponds to that within the EU/EEA. However, the CJEU ruled through the Schrems II ruling that the United States could not be considered to have such an adequate level of protection at the time of the ruling.</i><p>- European Court of Justice (CJEU)<p>I always thought that by asking for permission in the privacy statement, and in the cookie banner analytics cookies are also explicit usually, it would be OK.<p>But indeed, even if you refuse the analytics cookies (I do that automatically, who doesn't?), that still does not stop the website from transferring PII to google analytics. I am assuming that here, not a user of analytics, but i suppose it will still work without cookies, maybe just a little less accurate.