Ireland's Data Protection Commission (DPC) has fined Google €403 million for breaching the General Data Protection Regulation in its handling of users' location data, concluding a six-year inquiry and ordering Alphabet Inc.'s (GOOGL, GOOG) subsidiary to bring its processing practices into compliance within six months.
The DPC investigation examined three Google features — 'Web & App Activity', 'Location History' and 'Location Accuracy' — covering the period from 25 May 2018, when GDPR came into force, to 4 February 2020. Regulators concluded that Google failed to process location data lawfully and fairly through Web & App Activity and Location History, and failed to demonstrate compliance with the lawfulness, fairness and transparency principle for the Location Accuracy feature. The DPC also noted that users could have been unaware their location was being used to influence them with advertisements or to infer their interests.
The inquiry was launched in February 2020 following complaints from several European consumer rights groups, including BEUC. The decision was made by Commissioners for Data Protection Des Hogan, Dale Sunderland and Niamh Sweeney. DPC Deputy Commissioner Graham Doyle said the retention of users' location data for longer than necessary aggravated the loss of control by individuals [Source: RTÉ].
A Google spokesperson said the case centres on historical policies that have since been updated, adding that from 2019 onwards the company has significantly evolved its practices and launched tools to make managing location data simple [Source: RTÉ]. Changes introduced by the company include settings to automatically delete data, ad management tools, and increased transparency around how data is used.
The €403 million penalty is the fourth largest fine among the more than €4 billion in total levied by the DPC since it became the lead EU regulator for most major US technology firms under GDPR [Source: Reuters]. The Irish DPC acts as Google's lead regulator in the EU because of the location of many US technology companies' European operations in Ireland. Under GDPR, data protection authorities can impose administrative fines of up to €20 million or 4% of a company's total worldwide annual turnover, whichever is higher. The ruling follows the DPC's €310 million fine against LinkedIn Ireland in October 2024. Google separately agreed a $391 million settlement with a coalition of US state attorneys general in November 2022 over location tracking practices.
Sources: Data Protection Commission (Ireland), Euronews, RTÉ, The Guardian, Irish Examiner, Reuters