In The Register last month. Via ~this week in security~
The regulator ordered an unnamed website manager to strip Google Analytics out of their site, giving him a month to comply. It added: “Concerning the audience measurement and analysis services of a website, the CNIL recommends that these tools be used only to produce anonymous statistical data, thus allowing an exemption from consent if the data controller ensures that there are no illegal transfers.”
I see the beginning of a crack down