The DPC gave Google six months to fix the location processing it fined 403 million euros
Ireland's Data Protection Commission found lawfulness, fairness and retention failures in Web & App Activity and Location History, and transparency failures in all three location features it examined. One of them runs for Android users who never signed in.
The Watch · Security desk
What happened
- Ireland's Data Protection Commission fined Google 403 million euros over its processing of location data in three features between 25 May 2018 and 4 February 2020.
- The DPC opened the own-volition inquiry in February 2020 after complaints from European consumer rights organisations including BEUC, acting as lead supervisory authority for Google Ireland Limited.
- It found that the processing behind Web & App Activity and Location History broke the GDPR requirements for lawfulness and fairness, and that location data from both was retained too long.
- On Location Accuracy, an Android OS feature, Google could not demonstrate compliance with lawfulness, fairness and transparency, and the DPC found transparency breaches across all three features.
- The decision, taken by Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney, orders Google to bring its location processing into compliance within six months.
Why it matters
- What it costs cost Google's US settlements over the same location practice come to roughly five times this fine, so the European penalty is the smaller bill on conduct that ended in February 2020.
- What it limits constraint An accountability failure sets the bar at demonstrable compliance.
- Who has to decide decision Location Accuracy ships inside Android and works for users who never signed into a Google Account. Remediation there is an operating system change.
- What it sets up precedent A transparency finding that lands on a feature with no consent switch of its own tells other vendors that disclosure copy for OS-level telemetry is auditable.
Next story · Product · 2d ago
Google's opt-in Messages setting has Gemini judge what unknown senders wantConfirmed6 publishers
The behaviour behind the complaints has been public since 2018. An Associated Press report that year found that switching off Location History did not stop Google saving some location data, and Princeton researchers later confirmed it [23]. The cause was a second setting. Web & App Activity also collected location data, and turning off Location History did not turn it off [24]. The DPC looked at the question in 2018 after the AP work [9]. The window it eventually examined runs about 20 months [22]; the case took six years from the first complaints to a decision [19].
The full decision will be issued in due course, the DPC said [14]. The published account names the principles Google breached and the features involved. The DPC has not yet published the reasoning that connects the layout of the two settings to the transparency finding. On the current record this is an enforcement action about what users were told. Whether the off-switch design itself is the violation is a question the decision text will answer.
Deputy Commissioner Graham Doyle put the emphasis on the data. "Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private," he said [11]. The regulator's stated harm is specific: users may not have known their location data was being used to influence them with advertisements or to infer their interests. The DPC said that could result in individuals losing control of their personal data, and that retention beyond what was necessary aggravated it [12].
Google has paid for this practice before, in dollars. The US payouts are $85 million to Arizona in October 2022, $392 million to 40 states that November, $9.5 million to the District of Columbia the following month, $39.9 million to Washington State in 2023, $1.38 billion to Texas in May 2025, and a $425 million jury award in a class action last September [20]. Add them and the total is about $2.33 billion [25]. The Irish fine converts to $459 million [2], so the American payouts come to roughly five times it [26].
Google told Bloomberg it had revised its practices since 2019 and launched tools to make location data easier to manage [15]. In December 2023 it said Timeline data would be kept on users' devices, and that for people turning on Location History for the first time the default deletion period would fall from 18 months to three months [16]. The DPC has two other Google inquiries open, one into the processing of EU residents' data for its AI model, opened two years ago, and one into its online Ad Exchange, opened in 2019 [21].
What to watch
- The full decision text, and whether the transparency finding rests on the relationship between Location History and Web & App Activity.
- What Google changes in Location Accuracy inside the six-month compliance window, given the feature ships with Android.
- Whether Google challenges the fine or the compliance order in the Irish courts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence75
Perspective Coverage
12 publishers- Builder
- Builder 22%
- Operator
- Operator 53%
- Investor
- Investor 25%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Irish Data Protection Commission imposed administrative fines totalling 403 million euros on Google following an inquiry into its processing of location data through Web & App Activity, Location History and Location Accuracy.
- [2]
The 403 million euro fine is equivalent to $459 million.
- [3]
The DPC launched the own-volition inquiry in February 2020 after receiving complaints from several European consumer rights organisations, including BEUC.
- [4]
The DPC's final decision found that Google infringed the GDPR in relation to the lawfulness and fairness of its processing of location data through Web & App Activity and Location History, and identified issues with its retention of location data through those two features.
- [5]
The DPC found Google failed its accountability obligations regarding Location Accuracy, being unable to demonstrate compliance with the GDPR principles of lawfulness, fairness and transparency in processing personal data through that feature.
- [6]
The DPC identified transparency breaches across all three features.
- [7]
The DPC found that Google kept location data for longer than allowed.
- [8]
The inquiry covered location data processing in the three features from 25 May 2018, when the GDPR came into application, to 4 February 2020.
- [9]
The DPC first looked into the issue in 2018 after the AP investigation.
- [10]
The DPC acted as the Lead Supervisory Authority for Google Ireland Limited.
- [11]
"Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private."
- [12]
The DPC said Google's failures could have resulted in individuals being unaware their location data was being used, including to influence them with advertisements or infer their interests, that this could result in loss of control over their personal data, and that retaining the data for longer than necessary aggravated that loss of control.
- [13]
The DPC ordered Google to bring its processing into compliance within six months, and the decision was made by Data Protection Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney.
- [14]
The DPC said the full decision will be issued in due course.
- [15]
Google told Bloomberg it had revised its practices since 2019 and launched tools to make location data easier to manage.
- [16]
In December 2023 Google announced it would change its Timeline feature to keep its data on users' devices, and that for people turning on Location History for the first time the default period before automatic deletion would fall from 18 months to 3 months.
- [17]
Location Accuracy is an Android OS feature designed to determine a device's location more accurately than GPS inputs alone, and unlike the other two features it is available to Android users regardless of whether they have a Google Account.
- [18]
Location History is an opt-in service that tracks a user's location on a compatible mobile device and uses Google's Timeline function to display a private map of places visited, saving location information for signed-in devices even when the user is not using a Google service.
- [19]
The investigation took six years from the initial complaint to the final decision.
- [20]
Google agreed to pay $85 million to Arizona in October 2022, $392 million to 40 states that November, $9.5 million to the District of Columbia the following month, $39.9 million to Washington State in 2023 and $1.38 billion to Texas in May 2025 as part of a two-suit settlement; last September a jury awarded $425 million in a separate class action.
- [21]
The DPC launched an inquiry into Google's processing of EU residents' data for its AI model two years ago, and another into the processing of personal data for its online Ad Exchange in 2019.
- [22]
The examined processing window of 25 May 2018 to 4 February 2020 is about 20 months.
- [23]
A report by the Associated Press in 2018 found that turning off the Location History setting was not enough to stop Google saving some location data, and researchers at Princeton University later confirmed the AP's findings.
- [24]
Web & App Activity, a separate Google account setting, was also collecting location data, and turning off Location History did not turn off Web & App Activity.
- [25]
Those US payouts total about $2.33 billion.
- [26]
The US payouts are roughly five times the Irish fine measured in dollars.
Sources
12 independent publishers whose own reporting we read for this story.
- bbc.comGoogle fined €403m by Irish data watchdog over location tracking
1 article · September 21, 2026
- bleepingcomputer.comGoogle fined €403 million over location data privacy violations
2 articles · September 21, 2026
- cyberinsider.comIreland fines Google €403 million over location data processing
1 article · September 21, 2026
- helpnetsecurity.comGoogle hit with €403 million GDPR fine over location tracking
2 articles · September 21, 2026
- infosecurity-magazine.comGoogle Hit with €403m GDPR Fine Over Location Data Practices
2 articles · September 21, 2026
- malwarebytes.comGoogle’s location data privacy failures draw a €403 million fine
1 article · September 24, 2026
- politico.euGoogle hit with €403M privacy fine over handling of user location data – POLITICO
1 article · September 21, 2026
- securityaffairs.comGoogle Fined €403 Million Over Location Data Practices
1 article · September 21, 2026
- securityweek.comGoogle Hit With $463 Million Fine for EU Location Data Rule Breach
1 article · September 21, 2026
- thecyberexpress.comGoogle Faces €403 Million GDPR Fine Over Location Tracking
1 article · September 21, 2026
- thehackernews.comGoogle Fined €403 Million Over GDPR Violations Tied to Location Data
1 article · September 21, 2026
- therecord.mediaEU data regulator fines Google more than $460 million for location data violations
1 article · September 21, 2026
Topics and entities
Topics
- GDPR Enforcement
- Location data privacy