Six-Year GDPR Probe Ends With €403 Million Penalty Against Google
Ireland's Data Protection Commission has imposed €403 million ($463 million) in fines on Google after concluding that the technology company violated European privacy law in its handling of users' location information.
The September 21 decision concludes an investigation opened in February 2020 following complaints from European consumer organizations, including BEUC. It examined Google's practices between May 25, 2018 and February 4, 2020.
Google has also been ordered to bring the affected processing into compliance with the General Data Protection Regulation within six months.
Three Location Features at Center of Investigation
The regulator examined Web & App Activity, Location History and Location Accuracy, three systems capable of processing information about where users are or have been.
Web & App Activity can combine activity across Google services with information including location data, while Location History historically recorded movements from signed-in devices to create a private Timeline.
Location Accuracy operates differently. Built into Android, it improves positioning beyond GPS alone and is available even to Android users without Google accounts.
The DPC found violations involving lawfulness and fairness in Web & App Activity and Location History. It also found transparency failures across all three services and concluded that Google retained certain location information longer than permitted.
Regulator Says Users Could Lose Control of Their Data
The privacy implications extend beyond simply recording a device's coordinates.
The DPC said location information can reveal inherently private aspects of an individual's life. Insufficient transparency could leave people unaware that their movements were being used to infer interests or influence the advertising presented to them.
Keeping location information longer than necessary further reduced users' control over their personal data, the regulator concluded.
Google Says Practices Have Changed
Google disputes the relevance of the findings to its current products, saying the investigation concerns practices dating back several years.
The company says that since 2019 it has introduced stronger controls for managing location information, automatic deletion options and changes designed to reduce the amount and precision of location data retained.
The ruling nevertheless requires Google to ensure its processing complies with GDPR requirements within six months.
Location Data Remains a Major Privacy Risk
The case demonstrates why geolocation information receives heightened regulatory scrutiny.
Unlike many individual data points, long-term location records can reconstruct patterns of daily life—potentially revealing workplaces, homes, medical visits, religious activity and other sensitive behavior.
The €403 million sanction therefore reaches beyond Google's historical settings. It reinforces a broader GDPR principle: collecting location information requires more than providing a setting or obtaining nominal consent. Companies must clearly explain the processing, establish a lawful basis, minimize retention and give users meaningful control over how their movements are used.