By the close of 2021, EU data protection authorities (“DPA”) had initiated investigations into a number of US tech companies operating in Europe and further investigations are set to continue. In a recent case concerning Google and Facebook, the French DPA found that existing cookie consent mechanisms violated GDPR and significant fines were issued as a result. In another recent notable decision, the Austrian DPA scrutinised the legality of data transfers from an EU website to Google in the US, through the use of Google Analytics; depending on the reaction of other member states, this may have wide-ranging consequences for organisations using Google Analytics across the EU.