Google fined €403m over EU location data breaches

Ireland’s Data Protection Commission has imposed administrative penalties totalling €403 million on Google Ireland Limited for breaches of the EU’s General Data Protection Regulation relating to the processing of users’ location data. The decision represents a significant enforcement action under the bloc’s privacy framework and targets how Google collected, used, and retained location information tied to user accounts.

The case centres on Google’s account-level settings and features that govern location tracking and use, rather than on a single product. The regulator concluded that several aspects of these mechanisms did not comply with GDPR requirements for lawful, fair, and transparent processing of personal data.

The DPC opened a statutory inquiry into Google’s location-data practices in February 2020. The investigation examined processing activities from the GDPR’s entry into force in May 2018 through early 2020, covering a period when core user-account settings for location services were in active use.

Regulators found that the lawfulness and fairness requirements of the GDPR were not met in relation to how location data was processed within the Web & App Activity and Location History settings. In addition, the DPC identified accountability and transparency failures in the operation of the Location Accuracy feature.

The inquiry also concluded that Google retained certain categories of location data in Web & App Activity and Location History for longer than was necessary for the purposes for which the data was processed. This extended retention was assessed as being inconsistent with GDPR rules on storage limitation.

Beyond the financial penalties, the DPC ordered Google to bring the relevant processing operations into compliance with GDPR within six months. The order covers the location-related account settings and features that were the focus of the inquiry, including Web & App Activity, Location History, and Location Accuracy.

The enforcement decision is administrative in nature and forms part of the EU’s broader data protection regime. It is subject to Ireland’s statutory mechanisms, which provide avenues for challenge within the national legal framework.

Google stated that the case concerns historical policies that have since been updated. The company referenced changes introduced from 2019 onwards, such as auto-delete controls designed to limit how long certain data is stored and tools that allow users to manage how their location information is used for advertising.

By highlighting these measures, Google signalled that its current approach to location-data handling has evolved from the period reviewed by the DPC. The regulatory order, however, requires the company to ensure that any remaining non-compliant processing identified in the decision is corrected within the prescribed six-month timeframe.