EU regulators have fined Google €403 million ($463 million) for improperly handling users' location data in Web & App Activity, Location History and Android's Location Accuracy feature. Ireland’s Data Protection Commission, acting as lead regulator because Google’s EU headquarters are in Dublin, reviewed practices from 2018 through February 2020. Google says the issues relate to historical policies updated from 2019 onward; the DPC still has three other ongoing investigations into Google.
Google Fined €403M ($463M) Over EU Location-Data Breaches — Ireland’s DPC Issues Penalty
FILE - A sign is displayed on a Google building at their campus in Mountain View, Calif., Sept. 24, 2019. (AP Photo/Jeff Chiu, File)
Google has been fined €403 million ($463 million) by Ireland’s Data Protection Commission (DPC) for mishandling users’ location data, the regulator announced Monday. The ruling concludes that Google failed to process location information lawfully, fairly and transparently in several settings between 2018 and February 2020.
What the DPC Found
The DPC’s investigation — opened six years ago and led by Ireland because Google’s European headquarters are in Dublin — identified shortcomings in three areas:
- Web & App Activity: A Google setting that records browsing and search activity.
- Location History: The service that maps where a user has been using their mobile device.
- Location Accuracy (Android): A feature that processes personal data to improve location precision on Android devices.
"Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private." — Deputy Commissioner Graham Doyle
Google's Response
"This case centers around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple," Google said in a statement.
The DPC said the examination covered how Google applied the EU’s General Data Protection Regulation (GDPR) from its 2018 start until February 2020. The regulator described location data as personal data capable of revealing sensitive information about individuals’ movements and habits.
Wider Context
The €403 million fine is the fourth-largest privacy penalty issued by Ireland’s regulator to date; the DPC has previously levied larger fines against companies including TikTok and Meta, the latter receiving a €1.2 billion penalty. The regulator also said it has three other ongoing privacy investigations involving Google.
Users concerned about location tracking should review their Google account settings (Web & App Activity and Location History) and Android location controls to manage what data is collected and how it is used.
Help us improve.
