Irish regulator fines Google €403m over location data

Google has been fined €403 million by Ireland's Data Protection Commission over the way three of its features handled location data. The regulator's final decision, announced on 21 September, also orders the company to bring its processing into compliance within six months.

What the inquiry examined

The DPC opened the inquiry itself in February 2020, after complaints from several European consumer rights organisations, including BEUC. It looked at three specific features - Web & App Activity, Location History and Location Accuracy - over the period from 25 May 2018, when the GDPR took effect, to 4 February 2020.

Four findings, one bill

The decision was made by the Commissioners for Data Protection, Dr Des Hogan, Dale Sunderland and Niamh Sweeney. They found that Google infringed the GDPR on the lawfulness and fairness of its processing in Web & App Activity and Location History; on its accountability obligations, because it could not demonstrate compliance with the lawfulness, fairness and transparency principle for Location Accuracy; on transparency across all three features; and on the retention of location data in Web & App Activity and Location History. The DPC says it will publish the full decision in due course.

Why Dublin is cross about location

Deputy Commissioner Graham Doyle put the harm in plain terms. Location data, he said, "can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private". The consequence of Google's failures, he added, was that "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data". He noted that keeping the data for longer than necessary "aggravated this loss of control".

Location Accuracy is the odd one out in the case. It is an Android operating-system feature available to anyone with an Android device, whether or not they hold a Google account, which is why the finding against Google there rests on accountability rather than consent. It also helps explain why this fine is not simply a repeat of the earlier tracking complaints: the regulator is objecting to Google's inability to show that what it did was lawful, not only to the act itself.

Google's answer, and a complaint about the clock

Google said the case concerns "historical policies" that have since been updated. "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple," a spokesperson said. Users can now set location data to delete automatically after a period of between three and 36 months, the Timeline map is kept on the device, and the controls for ad personalisation have been simplified. It is understood the company may appeal elements of the decision.

BEUC, which submitted one of the original complaints, welcomed the outcome and attacked how long it took to reach. "The time needed to come to this conclusion is disproportionate with the seriousness of the infringement," said its director general, Agustín Reyna. "Late enforcement can be as harmful as no enforcement at all." At €403 million the penalty is the fourth largest the DPC has handed down since the GDPR came into force, behind Meta's €1.2 billion fine in 2023.

Our opinion

The interesting thing about this fine is what Google is not accused of. The company is not being told it had no basis for handling location data; it is being told it could not show that its basis was sound and that it did not explain itself clearly enough. That is a paperwork failure in the same way that a missing fire certificate is a paperwork failure - right up to the moment the building burns.

Both sides then perform their usual ritual. Google points out that the behaviour ended years ago and that it now offers auto-delete windows, which is a strange thing to advertise as a privacy feature: the firm that tracked your movements is offering to forget them, eventually, if you ask. The regulator collects a cheque, announces the fourth-largest penalty of its career and confirms it will publish the reasoning later. BEUC is right that the arithmetic here is ugly. The conduct covers 2018 to 2020, the decision lands in September 2026, and the compliance order gives Google another six months on top. The order is the part worth watching, because it forces a change in behaviour rather than a line in a quarterly filing - and it is the part a company cannot absorb quietly.