The Irish Data Protection Commission has fined Google €403m for unlawfully processing location data in Web & App Activity, Location History and Location Accuracy between 25 May 2018 and 4 February 2020. The DPC found Google’s practices breached the GDPR by failing to be lawful, fair and transparent, and said prolonged retention of location data aggravated users’ loss of control. Google says the case concerns historical policies and highlights changes since 2019, including auto-delete options and simplified ad controls. The company has six months to bring its processing into compliance.
Ireland Hits Google With €403m Fine Over Misuse Of Location Data
Dentist who stole £92,500 from NHS gets jail sentence
Google has been hit with a €403 million (£345m) fine by the Republic of Ireland’s Data Protection Commission (DPC) after the regulator found the company unlawfully processed users’ location data.
Investigation and Findings
The DPC’s inquiry — opened six years ago following complaints from several European consumer rights organisations — examined Google’s handling of location data in three settings: Web & App Activity, Location History and Location Accuracy. The probe covered the period from 25 May 2018 to 4 February 2020 and concluded that Google processed location information in ways that were not "lawful, fair or transparent," in breach of the EU’s General Data Protection Regulation (GDPR).
"It can reveal a significant amount of information about an individual, including information that is inherently private," said DPC Deputy Commissioner Graham Doyle.
The DPC also found that retaining users’ location data for longer than necessary "aggravated" users’ loss of control over their personal information.
Sanctions and Required Changes
In addition to the €403m penalty — one of the largest levied by the Irish regulator — Google has been ordered to bring its processing of location data into compliance within six months.
Google’s Response
Google said the case concerns historical policies that have since been updated. The company said that from 2019 it has "significantly evolved our practices" and introduced tools to make managing location data easier, including industry-first auto-delete controls (automatic deletion on a rolling three, 18 or 36-month basis), simplified ad controls to turn off personalised ads entirely, and clearer, consolidated information about location data practices and account settings.
Why This Matters
Location data can reveal sensitive aspects of people’s lives, from daily routines to personal interests. The DPC’s decision highlights regulators’ increasing scrutiny of how major tech firms collect, retain and use personal data for advertising and other purposes. The ruling may prompt further enforcement across the EU and encourage companies to adopt stronger privacy defaults and clearer user controls.
Next Steps
Google must comply with the DPC’s order within six months. The company has indicated it will point to policy changes since 2019 while addressing the regulator’s requirements.
Help us improve.
