Sunday 4 October 2026
Afternoon EditionRSS
ZOTPAPER

News without the noise

ZOTPAPER
Business

Google fined €403 million by Irish regulator over location data privacy violations

DPC finds company failed to meet GDPR transparency obligations and retained location data for too long

By LineZotpaper
Published
Read Time2 min
Sources2 outlets
Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463 million) for multiple violations of the General Data Protection Regulation (GDPR) related to its processing of users' location data, the regulator announced Monday. The fine follows a four-year investigation that began in February 2020 after complaints from consumer rights organisations.

The DPC examined three Google features active between May 2018 and February 2020: Web & App Activity, Location History, and Location Accuracy. It found that Google processed location data through Web & App Activity and Location History without meeting GDPR requirements, and failed to demonstrate compliance when processing data through Location Accuracy.

"Individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," said Deputy Commissioner Graham Doyle. "The retention of users' location data for longer than necessary aggravated this loss of control."

The regulator alleges Google failed to meet transparency obligations for all three features and retained location data from Web & App Activity and Location History longer than necessary. The DPC has ordered Google to bring its processing into compliance within six months.

In a statement to BleepingComputer, a Google spokesperson said the case "centers around historical policies that have since been updated." The company noted it has added tools letting users set automatic deletion timelines for location data, and that Google Maps Timeline information is now stored on devices with data automatically removed after three months. Google also said it does not save precise device location in Web & App Activity, only an estimated general area.

The DPC has not yet published its full decision but said it will do so in the future.

§

Analysis

Why This Matters

  • The fine reinforces the GDPR's requirement that companies obtain meaningful consent for location tracking and maintain transparency.
  • Users may not realise how their location data is used for advertising and profiling, and this case highlights the need for clearer controls.
  • The ruling sets a precedent for how EU regulators will scrutinise other tech companies' location practices.

Background

The DPC is the lead supervisory authority for many US tech companies including Google under the GDPR's 'one-stop-shop' mechanism, because their EU headquarters are in Ireland. This is one of several large fines the DPC has issued against major platforms in recent years. Google has previously faced EU-level antitrust fines, but this penalty is specifically for privacy violations.

Key Perspectives

Data Protection Commission: The regulator argues that users lost control over their personal data because Google's processing was opaque and retention periods were excessive, violating core GDPR principles. Google: The company maintains that the practices in question are historical and that it has since introduced robust tools for location data management, including automatic deletion and on-device storage for Maps Timeline. Consumer rights organisations: Groups that filed the original complaints have repeatedly raised concerns about Google's tracking-by-default approach and the difficulty users face in understanding and controlling location permissions.

What to Watch

  • Whether Google appeals the fine to the Irish courts, which could prolong the case.
  • Whether the DPC publishes additional details or expands the scope of the probe to other Google services.
  • How other EU data protection authorities respond, as they may launch parallel investigations into similar practices.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workReport an errorSubscribe