Google Fined €403M Over Location Data

Ireland's Data Protection Commission has fined Google €403 million for breaking the EU's General Data Protection Regulation in the way three of its features handled people's location data between May 2018 and February 2020. The penalty, announced by the regulator Google answers to in the EU, is the fourth-largest the DPC has issued. It cannot be collected yet, because a DPC fine becomes payable only after an Irish court confirms it.

The Three Features Under Scrutiny

The DPC's inquiry examined Web & App Activity, Location History and Location Accuracy. Each works differently, and the regulator's findings differ across them.

Web & App Activity is a Google account setting that, when turned on, lets Google process data about a user's activity on its sites and apps. That data can include location. Location History, which users must opt in to, keeps track of where they go with their signed-in mobile devices, even when they are not using a Google service. For both of these, the DPC found that Google breached the GDPR's rules on lawful and fair processing and on transparency, and that it retained location data longer than necessary.

Location Accuracy is an Android feature that works out a device's location more precisely than GPS alone, and it is available to Android users with or without a Google account. The DPC's findings for this feature are narrower: Google broke the transparency rules and the GDPR's accountability rules because it could not demonstrate that this processing was lawful, fair and transparent.

What the Regulator Says Went Wrong

DPC Deputy Commissioner Graham Doyle said these failures meant people could have been unaware that their location was being used, for example, to influence them with ads or to infer their interests. They could also lose control of their personal data, and keeping it for so long made that worse.

The regulator also ordered Google to make its processing comply with the law within 6 months. The DPC has not said publicly which processing the order covers, and it says its full decision will be published later.

Google's Response and Its Policy Changes

In a statement reported by the Associated Press, Google said the case "centers around historical policies that have since been updated" and that it has changed its practices significantly since 2019.

"centers around historical policies that have since been updated"

— Google, in a statement reported by the Associated Press

Those changes have come in stages. In May 2019, during the period the DPC examined, Google announced auto-delete controls for Location History and Web & App Activity, letting users have that data deleted automatically after 3 or 18 months. In June 2020, Google made 18-month auto-delete the default for Web & App Activity on new accounts and for anyone turning on Location History for the first time.

In December 2023, Google announced that Timeline, the Google Maps feature that shows Location History on a map, would keep its data on users' devices. Auto-delete would also default to 3 months for anyone turning on Location History for the first time. The DPC has not publicly said whether these changes are sufficient to meet its order.

Where the Case Came From

The DPC opened its inquiry in February 2020 after complaints from European consumer groups, including BEUC, the European Consumer Organization. BEUC's member groups had filed the complaints with national data protection authorities in November 2018. The period the DPC examined ends on 4 February 2020, the day it announced the inquiry.

The decision came more than 6.5 years after the inquiry opened. In comments reported by NewsIreland.EU, BEUC director general Agustín Reyna welcomed it but criticized how long it took.

"Late enforcement can be as harmful as no enforcement at all,"

— Agustín Reyna, director general of BEUC

Key Figures in the Decision

• The fine: €403 million
• Ranking: the fourth-largest the DPC has issued
• Compliance deadline: 6 months
• Conduct period examined: May 2018 to February 2020
• Inquiry opened: February 2020
• Complaints filed with national authorities: November 2018
• Time from inquiry to decision: more than 6.5 years
• Appeal window: 28 days from formal notice

The Appeal Path and Court Confirmation

Google can appeal to the High Court within 28 days of receiving formal notice of the decision. Until an Irish court confirms the fine, the DPC cannot collect it.

The regulator says its full decision will be published later. That publication would give the public and the company the detailed reasoning behind the findings, including how the DPC weighed the three features against the GDPR's requirements on lawful and fair processing, transparency, and accountability.

What the Regulator Found, in Detail

The DPC's findings split along feature lines. For Web & App Activity and Location History, the regulator found breaches of the GDPR's rules on lawful and fair processing and on transparency, along with retention of location data longer than necessary. For Location Accuracy, the finding was narrower: transparency rules and accountability rules were broken because Google could not demonstrate that the processing was lawful, fair and transparent.

DPC Deputy Commissioner Graham Doyle said the failures meant people could have been unaware their location was being used — for example, to influence them with ads or to infer their interests. He also said people could lose control of their personal data, and that long retention made that worse.

What the Ruling Means Going Forward

For Google, the immediate tasks are the 6-month compliance window and, if it chooses, a High Court appeal within 28 days of formal notice. The company has already pointed to policy changes made since 2019 as evidence its practices have moved on. The DPC has not said whether those changes satisfy its order, and its full decision has yet to be published.

For other organizations that collect location data, the decision reflects the standard the DPC applied here: lawful and fair processing, transparency, and not retaining data longer than necessary. Companies that rely on location data may want to ask whether they could demonstrate the same things if a regulator asked.

For consumers, the case concerns settings they may have turned on years ago. Web & App Activity and Location History determine how much of a person's movement is recorded and how that record is used. Auto-delete controls, now defaulting to 18 months for new accounts and for first-time Location History users, and to 3 months for Timeline on-device storage, are the tools Google has put in place since the period the DPC examined.

Whether the €403 million fine survives an appeal, and whether the policy changes satisfy the compliance order, will shape what this decision means in practice. For now, it stands as the fourth-largest fine the DPC has issued — and one that cannot be collected until an Irish court confirms it.