Google Fined €403M by Ireland for GDPR Location Data Breaches

Ireland's Data Protection Commission fined Google €403 million on 21 September 2026 for breaching GDPR by unlawfully processing location data across Web & App Activity, Location History, and Location Accuracy features between May 2018 and February 2020. The DPC found Google failed to process data lawfully, fairly, and transparently, and retained it longer than necessary, leaving users unaware their location was used for advertising and profiling. Google must comply within six months and can appeal the decision, the fourth-largest fine issued by the Irish regulator.

Quick Facts

Google fined €403 million for GDPR violations
Unlawful processing of location data in Web & App Activity, Location History, and Location Accuracy
Failure to process data lawfully, fairly, and transparently
Excessive retention of location data
DPC ordered compliance within 6 months

Ireland's Data Protection Commission (DPC) imposed a €403 million fine on Google on 21 September 2026 for unlawfully processing users' location data across three features: Web & App Activity, Location History, and Location Accuracy. The investigation, launched in February 2020 following complaints from European consumer organizations including BEUC, examined Google's practices between 25 May 2018 and 4 February 2020.

The DPC found that Google failed to process location data in a lawful, fair, and transparent manner across all three features. For Web & App Activity and Location History, regulators determined Google breached GDPR's lawfulness, fairness, and transparency requirements, and retained information longer than necessary. For Location Accuracy, an Android feature, the DPC found Google could not demonstrate lawful, fair, and transparent processing and violated accountability obligations. The investigation revealed that users could have been unaware their location was used to influence advertisements or infer interests, and could lose control over personal data—a problem aggravated by excessive retention.

Location data, regulators noted, is inherently sensitive personal information that can reveal religious beliefs (through places of worship), political views (through protest attendance), health conditions (through hospital visits), and sexual orientation (through location patterns). The DPC emphasized that while location data can enhance online services, it poses significant privacy risks when processed without proper consent and transparency. The investigation was sparked by 2018 research from the Norwegian Consumer Council suggesting Google used "various tricks" to enable these tracking features.

Google responded that the case "centers around historical policies that have since been updated," citing changes introduced from 2019 onwards. In May 2019, Google launched auto-delete controls allowing users to delete Location History and Web & App Activity data automatically after 3 or 18 months. In June 2020, it made 18-month auto-delete the default for Web & App Activity on new accounts. In December 2023, Google announced that Location History data (Timeline feature) would be stored on users' devices and that the default auto-delete period would become 3 months for new Location History users. The DPC did not publicly confirm whether these changes satisfy its compliance order.

The DPC ordered Google to bring its processing into compliance within six months. At €403 million, this is the fourth-largest fine issued by the Irish regulator, which has EU-wide responsibility for Google's data protection compliance. The agency has previously fined Meta €1.2 billion, TikTok €530 million, and Instagram €405 million. The fine becomes payable only after an Irish court confirms it. Google can appeal to the High Court within 28 days of receiving formal notice. The DPC has three other ongoing privacy investigations involving Google.

Topics

Politics Technology Business World

#consumer rights #EU regulation #location tracking #Google fine #consent #fines #European Union #Ireland DPC #GDPR #Ireland

Entities

Why This Matters

This fine establishes regulatory precedent for location data processing across EU-regulated tech platforms and may influence how Google and competitors handle sensitive geolocation features globally. The four-year investigation period (May 2018–February 2020) and €403 million penalty signal heightened enforcement of GDPR transparency and consent rules for mobile tracking; compliance orders within six months will require measurable changes to data retention, auto-delete defaults, and user notification mechanisms. Future decisions on whether Google's post-2019 updates (3/18-month auto-delete, device-side storage) satisfy the DPC's order will determine enforceability scope.

Timeline & Sources

Jan 1, 2018

Wire

Norwegian consumer agency research suggests location data can reveal sensitive personal information

May 25, 2018

Wire

GDPR enters into force; Google's location data processing practices under investigation begin

Sep 21, 2026

Wire

DPC announces €403 million fine and orders compliance within 6 months; Google has 28 days to appeal to Irish High Court

Sep 21, 2026

Wire

DPC announces €403 million fine for GDPR violations

Quick Facts

Topics

Entities

Why This Matters

Timeline & Sources

Related Signals

Sources