What is Schrems III and would it affect analytics?

Schrems III is the informal name given to the fresh challenge to the EU-US Data Privacy Framework announced by noyb in 2026, following a US Supreme Court ruling that June on removal protections for FTC commissioners. If a challenge ultimately succeeded, every EU-to-US transfer resting on the Framework would need an alternative legal basis. Analytics and AI vendors that transfer personal data to US-jurisdiction providers would be directly affected.

What happens to my analytics if the Data Privacy Framework is struck down?

Any flow of personal data to a US provider that relies on the Framework as its Chapter V basis would lose that basis on the day of the ruling. You would need Standard Contractual Clauses plus a Transfer Impact Assessment and supplementary measures, renegotiated with each affected vendor. Setups where no personal data leaves the EU, and where the processor has no US parent, are unaffected because Chapter V is never engaged.

Have EU-US data transfer agreements been struck down before?

Twice. Safe Harbor was invalidated in 2015 and Privacy Shield in 2020, each after a challenge reached the Court of Justice of the EU. The Data Privacy Framework is the third arrangement of its kind. That history is not a prediction about the current case, but it is the reason many European data protection officers treat Framework-dependent architectures as carrying standing risk rather than settled certainty.

How do I make my analytics stack independent of EU-US transfer rules?

Remove the transfer rather than paper it. If your analytics collects no personal data at all, and any AI processing runs on a provider incorporated in the EU with no US parent, GDPR Chapter V is not triggered — there is no international transfer to justify. That is an architectural property, so it does not change when case law does.

Regulation

What Happens to Your Analytics if the EU-US Data Privacy Framework Falls

Q: Is the EU-US Data Privacy Framework still valid in 2026?

Yes, it remains in force. The first annulment action, Latombe v Commission (T-553/23), was dismissed by the EU General Court on 3 September 2025. An appeal, C-703/25 P, was lodged on 31 October 2025 and is pending before the Court of Justice of the EU. Separately, noyb wrote to the Commission on 30 June 2026 and announced a fresh challenge. The Framework is valid today; its future is genuinely uncertain.

July 24, 20266 min readBy Rafa Jiménez

Nobody knows how the pending challenges to the EU-US Data Privacy Framework will end. That is precisely the point: if your analytics stack has an answer that depends on the ruling, you are carrying a risk you cannot price. Some architectures do not have an opinion on the outcome at all.

Key Takeaways

The Framework is valid today. Latombe v Commission was dismissed on 3 September 2025; an appeal (C-703/25 P) is pending at the CJEU and a fresh challenge was announced in 2026.
Its two predecessors, Safe Harbor and Privacy Shield, were both struck down — which is why treating the current Framework as permanent is a bet rather than a plan.
If it fell, every Framework-dependent transfer would need a new Chapter V basis at once: Standard Contractual Clauses, a Transfer Impact Assessment and supplementary measures, per vendor.
An architecture where no personal data leaves the EU and the processor has no US parent never triggers Chapter V, so it is indifferent to how the litigation ends.

Ask a European marketing team what legal basis underpins their analytics stack and you will usually get an answer about consent. Ask what underpins the flow of that data to a US-owned vendor and the room goes quieter. In most cases the answer is the EU-US Data Privacy Framework — a Commission adequacy decision that a lot of tooling quietly stands on.

It is worth knowing exactly how solid that ground is, and what happens on the morning it is not.

Where the Framework actually stands

Three things are true at once, and mixing them up is where most commentary goes wrong.

It is in force. The first annulment action, Latombe v Commission (T-553/23), was dismissed by the EU General Court on 3 September 2025. The Framework survived. Anyone telling you it has already been invalidated is wrong.

It is under appeal. An appeal against that dismissal, case C-703/25 P, was lodged on 31 October 2025 and is pending before the Court of Justice of the EU. Appeals of this kind take time, and the outcome is unknown.

A second front opened in 2026. After a June 2026 US Supreme Court ruling on removal protections for FTC commissioners — a ruling that touches the independence of US oversight bodies — noyb wrote to the European Commission on 30 June 2026 and announced a fresh challenge, widely nicknamed "Schrems III."

None of that tells you how any of it ends. Litigation outcomes are not forecastable, and we are not going to pretend otherwise. What it tells you is that the Framework is a live legal question rather than a settled one, and that a plan which requires it to survive is a plan with an unpriced dependency.

Why the history matters

The Data Privacy Framework is the third arrangement of its kind. Safe Harbor came first and was struck down. Privacy Shield replaced it and was struck down too. The Framework replaced that.

Two invalidations do not make a third inevitable — the Framework was negotiated specifically to address the deficiencies the Court identified, and it has already won once in court. But the pattern explains why experienced data protection officers treat transfer-dependent architectures as carrying standing risk. Each previous collapse produced the same scramble: contracts reopened, assessments redone, some vendors quietly dropped.

What re-papering would actually involve

If the Framework were invalidated, the adequacy decision would stop being a lawful basis for transfers relying on it. Personal data flowing to affected US providers would then need an alternative Chapter V route, which in practice means Standard Contractual Clauses plus a Transfer Impact Assessment plus supplementary measures — assessed per vendor, per data category, per processing purpose.

For a mid-sized marketing stack, that is not a document. That is a project. Analytics, tag management, A/B testing, CDP, email, advertising platforms, session replay and now the AI features bolted onto several of them. Each with its own paperwork, its own subprocessor chain and its own account manager to chase.

And a Transfer Impact Assessment is not a formality. It requires you to assess whether the destination country's law permits access by public authorities in a way that undermines the safeguards — the exact question the Court has answered unfavourably twice before regarding US surveillance law. That is why the previous rounds were so painful.

Which setups are structurally immune

Here is the part worth internalising. Chapter V of the GDPR governs transfers of personal data to third countries. It engages when two conditions are met: there is personal data, and it goes somewhere outside the EU or to a party under foreign jurisdiction.

Break either condition and the chapter never applies. Not "applies but is satisfied" — never applies.

The first way to break it is to collect no personal data. Analytics that never collects IPs, cookies, fingerprints or visitor identifiers has no personal data to transfer in the first place. The second is to keep processing with an EU-incorporated processor that has no US parent, so no extraterritorial regime reaches it.

Do both and the litigation becomes a spectator sport. That is the design behind Seal AI: inference runs on Scaleway Generative APIs in Paris only. Scaleway is a French company whose parent is the Iliad group, with no US ownership, and it states explicitly that its AI services are not subject to extraterritorial laws such as the American CLOUD Act. It sits in our subprocessor list as a plain Article 28 processor — Scaleway SAS, Paris, France, purpose LLM inference, retention zero. There are no Standard Contractual Clauses in that chain because there is nothing for them to cover.

The related trap is assuming an EU region solves it. It does not: the CLOUD Act follows the corporate parent rather than the datacenter, which is the distinction we unpack in Residency Is Not Sovereignty.

What to check in your stack this quarter

This is a two-afternoon exercise, and it is worth doing before any ruling rather than after one.

List every vendor that touches visitor data — including the AI features that appeared inside tools you already had. Those often arrived with a new subprocessor and no new contract review.
For each, write down the Chapter V basis. Adequacy under the Data Privacy Framework, Standard Contractual Clauses, a derogation, or "none needed, no transfer." If nobody in the company can say which, that is the finding.
Flag everything in the first bucket. Those are the items that would need work on day one of an adverse ruling. Rank them by how much traffic or revenue depends on them.
Check the AI layer separately. Ask where inference runs, exclusively, and who owns that entity. A vendor may host its application in the EU while calling a model elsewhere.
Ask each flagged vendor what their plan is. The quality of that answer is itself information. Some have a real EU-processing path ready; some have a paragraph of reassurance.

You are not trying to rip out your stack. You are trying to know, in advance, exactly how long the list is — so that if the day comes, you are executing a plan rather than discovering the scope.

The bottom line

The Data Privacy Framework may well survive both challenges. We have no view on the merits and no crystal ball. But there is a meaningful difference between a compliance position that requires a court to rule a particular way and one that does not care.

The second kind is not cleverer lawyering. It is an architectural choice made earlier: collect nothing personal, process inside the EU with a processor no foreign statute can reach, and there is no transfer to defend. Case law changes. Architecture does not.