Ireland's DPC puts a €403m price on 620 days of Google location processing
The Data Protection Commission found four kinds of GDPR infringement across three location features and gave Google six months to comply. It has not yet published the full decision that says what complying means.
The Board Room · Leadership desk
What happened
- Ireland's Data Protection Commission announced €403m in fines against Google Ireland on 21 September 2026, closing an own-volition inquiry it opened in February 2020 after complaints from consumer groups including BEUC.
- The inquiry covered three features, Web & App Activity, Location History and Location Accuracy, and only the processing that took place between 25 May 2018 and 4 February 2020.
- Google said the case concerns historical policies that have since been updated, and that it has significantly evolved its practices from 2019 onwards.
Why it matters
- What it limits constraint Documentation becomes the deliverable for any feature whose lawful basis is arguable: a lead supervisory authority can test the evidence file long after the flow itself was retired, and an inability to produce it attracted a finding here on its own.
- Who has to decide decision Google has to decide what to change before the reasoning is public, because the six-month clock started with the announcement while the full decision is still to be issued.
- What doesn't add up contradiction Google calls the policies historical and updated from 2019, yet the DPC ordered present processing brought into compliance, so the two accounts cannot both describe the current state of the three features.
- Who's exposed exposure The Guardian reported three further DPC inquiries into Google at an advanced stage, so buyers reviewing Google services should expect more findings from the same regulator inside the same cycle.
Next story · Invest · Sep 21
Ireland prices Google's location-data window at about 650,000 euros a dayConfirmed5 publishers
The fine covers a fixed window, so it divides cleanly. From 25 May 2018 to 4 February 2020 is 620 days [21], and €403m over 620 days is about €650,000 for each day in scope [22].
The lawfulness and fairness finding does not cover all three features. It applies to Web & App Activity and Location History [4]. For Location Accuracy the DPC found that Google failed to be able to demonstrate compliance with the lawfulness, fairness and transparency principle [5]. Location Accuracy is an Android operating system feature available to Android users whether or not they hold a Google Account [11].
Retention came in as a separate infringement. The DPC found against Google's retention of location data in Web & App Activity and Location History [7], and Deputy Commissioner Graham Doyle said: "The retention of users' location data for longer than necessary aggravated this loss of control" [9].
The complaint that started the file was about how the choices were presented. According to the Guardian, BEUC based it on research by the Norwegian consumer agency claiming Google used "various tricks" to ensure Location History and Web & App Activity were enabled [18]. That 2018 research suggested location data could reveal religious belief from visits to places of worship, political leaning from attendance at demonstrations, health conditions from hospital visits and sexual orientation from visits to certain bars [17].
Google's answer is that the conduct is old. A company spokesperson said: "This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple" [12]. The DPC still ordered Google to bring its processing into compliance within six months of 21 September 2026, which puts the deadline in late March 2027 [8][20]. The regulator said it will issue the full decision in due course [10].
The lag is the part other controllers should price. The inquiry opened in February 2020 and the decision arrived on 21 September 2026, six years and seven months later [19]. Agustin Reyna, director general of BEUC, welcomed the ruling but said "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement", arguing that "late enforcement can be as harmful as no enforcement at all" [13].
€403m is the fourth-largest fine the Irish regulator has imposed [14]. It trails €1.2bn against Meta, €530m against TikTok and €405m against Instagram [15], landing €2m under the Instagram figure [23]. The Guardian reported that three other large-scale statutory inquiries into Google are open, all at an advanced stage [16].
What to watch
- The full decision text from the DPC, and whether it identifies which current Google settings fall short of the GDPR.
- Whether Google's changes by the late-March 2027 deadline are accepted by the DPC or contested.
- The three advanced-stage DPC inquiries into Google, and whether their fines land above or below €403m.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence84
- Adoption
- Not scored
- Hype gap+8
- Incentives58
- Confidence76
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Data Protection Commission announced on 21 September 2026 its final decision in an inquiry into Google Ireland Limited, imposing administrative fines totalling €403 million over Google's processing of location data.
- [2]
The own-volition inquiry was launched by the DPC in February 2020, in its role as Lead Supervisory Authority for Google, following complaints from several European consumer rights organisations including BEUC regarding Google's processing of location data.
- [3]
The inquiry's scope concerned Google's processing of location data in three features, Web & App Activity, Location History and Location Accuracy, between 25 May 2018 and 4 February 2020.
- [4]
The DPC found that Google infringed the GDPR in respect of the lawfulness and fairness of its processing of location data in Web & App Activity and Location History.
- [5]
The DPC found that Google infringed its accountability obligations under the GDPR by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle regarding its processing of personal data in Location Accuracy.
- [6]
The DPC found that Google infringed its transparency obligations in respect of all three features in scope.
- [7]
The DPC found that Google infringed the GDPR in respect of its retention of location data in Web & App Activity and Location History.
- [8]
The DPC ordered Google to bring its processing into compliance within 6 months.
- [9]
"The retention of users' location data for longer than necessary aggravated this loss of control", said Deputy Commissioner Graham Doyle.
- [10]
The DPC said it will issue the full decision in due course.
- [11]
Location Accuracy is a feature of Android OS that allows a device to determine its location with greater accuracy than by relying on GPS inputs alone, and it is available to Android users regardless of whether they are Google Account holders.
- [12]
"This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple", a Google spokesperson said in response to the DPC's ruling.
- [13]
Agustin Reyna, director general of BEUC, welcomed the ruling but said "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement", arguing "late enforcement can be as harmful as no enforcement at all".
- [14]
The €403m fine is the fourth-largest imposed by the Irish regulator, which has EU-wide responsibility for US tech companies with EU headquarters in Ireland.
- [15]
The Irish regulator has previously fined Meta €1.2bn, TikTok €530m and Instagram €405m.
- [16]
There are three other ongoing statutory large-scale inquiries open concerning Google, all of which are at an advanced stage.
- [17]
The DPC inquiry was prompted by 2018 research by the Norwegian consumer agency which suggested location data could reveal details such as religious beliefs (by tracking places of worship), political leanings (such as attendance at demonstrations), health conditions (hospital visits) and sexual orientation (visits to certain bars).
- [18]
BEUC based its complaint on research by the Norwegian consumer agency which claimed Google used "various tricks" to ensure location history and web and app activity were enabled.
- [19]
The decision arrived six years and seven months after the inquiry was opened.
- [20]
Six months from the 21 September 2026 decision puts the compliance deadline in late March 2027.
- [21]
The period in scope, 25 May 2018 to 4 February 2020, is 620 days.
- [22]
Spread across the 620-day window, the €403m fine is about €650,000 for each day in scope.
- [23]
The €403m fine is €2m below the €405m fine previously imposed on Instagram.
Sources
2 independent publishers whose own reporting we read for this story.
- Data Protection Commission fines Google €403 million following Inquiry into Google’s processing of location data | 21/09/2026 | Data Protection Commission
dataprotection.ie
1 article · September 21, 2026
- theguardian.comGoogle fined more than €400m by Irish regulator over its use of location data
1 article · September 21, 2026
Topics and entities
Topics
- Data Protection Enforcement
- Consent and dark patterns
- Location privacy