Today·Emerging
Follow-up 3h ago3
95%
Google fined €403m by Irish regulator over location data practices
Google has been fined €403 million by Ireland's Data Protection Commission for unlawful processing of location data, following a six-year investigation into practices that allowed users to be tracked without full awareness. The DPC found Google failed to process location data transparently and retained it longer than necessary, and has ordered compliance within six months. Google says the case concerns outdated policies and has since improved its practices.
Quick Facts
- Fine imposed for unlawful location data processing
- Investigation into Google's handling of location data
- Failure to process data lawfully, fairly, and transparently
- Users allegedly unaware location was being tracked
- Location data used for ad targeting and interest inference


Ireland's Data Protection Commission (DPC) has imposed a €403 million fine on Google for failing to process location data lawfully, fairly, and transparently. The decision, announced on 21 September 2026, follows a six-year investigation launched in February 2020 after complaints from seven European consumer rights organizations, including the European Consumer Organisation (BEUC) and Norway's Forbrukerrådet.
The DPC investigation examined Google's handling of location data between May 2018 and February 2020 across services including Google Search, Google Maps, and Android devices. The watchdog found that users may have been unaware their location was being tracked and used to influence advertisements, infer personal interests, and derive sensitive information such as religious beliefs, political leanings, health conditions, and sexual orientation. The investigation also determined that Google retained location data longer than necessary, compounding the loss of user control over personal information.
DPC Deputy Commissioner Graham Doyle stated that location data "can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private." The fine is the fourth-largest imposed by the Irish regulator, which has EU-wide responsibility for major US technology companies headquartered in Ireland. The DPC has ordered Google to bring its processing into compliance with the EU's General Data Protection Regulation (GDPR) within six months.
Google responded that the case concerns "historical policies that have since been updated." The company stated that from 2019 onwards it has "significantly evolved our practices and launched robust tools that make managing location data simple," including automatic data deletion settings and improved transparency features. Google is understood to be appealing the ruling on legal issues requiring clarification. The European Consumer Organisation welcomed the decision but criticized the duration of the investigation, arguing that delayed enforcement can be as harmful as no enforcement.
Why This Matters
Users in the EU may be affected by enforcement of stricter location data handling rules; Google must bring practices into GDPR compliance within six months, potentially affecting how location-based advertising, search, and mapping services operate. The fine—the DPC's fourth-largest—sets precedent for how major tech platforms must handle sensitive personal data that can infer religious beliefs, political views, health conditions, and sexual orientation. Consumer organizations have flagged that enforcement delays enable ongoing exposure of user data.
Timeline & Sources
Jan 1, 2018
WireNorwegian consumer agency (Forbrukerrådet) publishes research showing location data can reveal sensitive personal information
May 25, 2018
WireInvestigation period begins: DPC starts examining Google's location data practices
Feb 4, 2020
WireInvestigation period ends: DPC concludes examination of Google's location data practices
Sep 21, 2026
WireDPC announces €403 million fine against Google for GDPR violations in location data processing