Ireland's Data Protection Commission fined Google €403 million on September 21 after finding that the company mishandled location data across three features. The regulator also ordered Google to bring the processing into compliance with EU privacy law within six months.
The inquiry covered practices from May 25, 2018, when the EU's General Data Protection Regulation took effect, through February 4, 2020. It began after complaints from European consumer groups, including BEUC. That time frame matters: the decision addresses Google's practices during those years, not a fresh audit of every setting available today.
What the regulator found
The DPC said Google did not process location data lawfully and fairly in Web & App Activity and Location History. It also found transparency failures in those features and Android Location Accuracy, and said Google had not demonstrated that Location Accuracy met its duties for lawful, fair and transparent processing. The regulator found that Google kept some Web & App Activity and Location History data longer than necessary.
The three features collect or use location information in different ways. Web & App Activity can record activity on Google services, including searches, browsing and location data when the account setting is enabled. Opt-in Location History can build a private map of a person's travels on signed-in devices, even when a Google service is not being used. Android Location Accuracy helps a device determine its position more precisely than GPS alone and is available to people without Google Accounts.
Those distinctions help explain the regulator's concern. Location information can reveal where someone has been and, when combined with other data, may be used to infer interests or shape advertising. The DPC said people could have lacked a clear understanding of those uses and lost control of their data.
Google's response and what comes next
Google told the Associated Press that the case concerns historical policies. The company said it has changed its practices since 2019 and introduced tools for managing location data. That statement is Google's account of its changes; the DPC's order still requires compliance within six months.
The watchdog said it will publish the full decision later. Until then, its announcement sets out the findings and remedy but not every detail of how the violations were assessed. Reuters reported that the case followed consumer-group complaints and that the fine is among the largest Ireland has imposed under the EU privacy regime.
Tech