Irish regulator fines Google €403 million over location data handling
The Data Protection Commission found GDPR breaches across three Google location features and gave the company six months to bring processing into compliance.
By Tech CEO Daily Staff, Newsroom
· 3 min read
The news
Ireland’s Data Protection Commission (DPC) fined Google €403 million on September 21 after an inquiry into how the company processed users’ location data. The decision was taken by Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney.
The inquiry, opened in February 2020 after complaints from European consumer groups including BEUC, covered three features: Web & App Activity, Location History and the Android Location Accuracy setting. It examined the period from May 25, 2018, when GDPR took effect, to February 4, 2020.
The DPC found that Google breached GDPR rules on lawfulness and fairness for Web & App Activity and Location History, failed its transparency obligations across all three features, and kept location data in two of them longer than allowed. For Location Accuracy, the regulator found Google could not demonstrate compliance with its accountability duties. Google has six months to bring its processing into line.
Google told BleepingComputer the findings concern historical policies that have since been updated. The company pointed to changes including auto-delete tools, storing Maps Timeline data on the device, and no longer saving precise device locations in Web & App Activity. Neither the DPC release nor the coverage we reviewed said whether Google will appeal.
The numbers
- Fine
- €403 million
- Period examined
- May 2018 – Feb 2020
- Compliance deadline
- 6 months
- Google features covered
- 3
Why CEOs should care
The fine targets conduct from six to eight years ago, which is the point: GDPR enforcement moves slowly but does arrive. Any company collecting location data — retail apps, logistics, fleet tools, ad tech — should assume that consent flows and retention policies designed years ago can still be penalized today. The DPC specifically flagged unclear disclosures and over-long retention, two areas many firms treat as low priority.
For businesses that rely on Google’s location signals for advertising or analytics, expect the data available to continue shrinking. Google has already moved Maps Timeline data onto devices and reduced precision in account-level activity, which limits what flows downstream to marketers.
The bigger picture
Ireland’s regulator is the lead GDPR authority for many U.S. tech giants headquartered in Dublin, and its large fines have become a regular cost of doing business in Europe. This decision adds to a string of European actions against Google spanning privacy and competition.
What's next
Watch for Google’s compliance steps within the six-month window and any court challenge to the decision.
Sources
- GovernmentData Protection Commission fines Google €403 million following Inquiry into Google’s processing of location data— Data Protection Commission (Ireland)
- ReportGoogle fined €403 million over location data privacy violations— BleepingComputer
Newsroom
Reporting and analysis from the Tech CEO Daily newsroom. Each story is researched from primary sources — company announcements, regulatory filings and official advisories — and fact-checked before publication.
Spotted an error? Request a correction. Read our editorial standards and AI policy.
The Daily Brief
The technology briefing for people running businesses.
Weekdays at 6 a.m. ET. Free.
