The Data Protection Commission (DPC) of Ireland has imposed a €403 million ($463 million) fine on Alphabet's Google search engine for violations related to location data processing. According to reports from the DPC, this represents the fourth largest fine ever levied by the Irish watchdog, which serves as the lead EU regulator for most major U.S. internet companies due to their EU operations being located in Ireland. The €403 million fine is the fourth largest that the DPC has handed down since the GDPR came into force, with the largest remaining Meta's €1.2 billion fine imposed in 2023. This marks Google's first major penalty from the Irish regulator, highlighting the significance of the case. The Irish Data Protection Commission said Google was fined under the EU's data protection rules for failing to abide by rules on the 'lawfulness and fairness' of processing and retaining location data and failing to meet its transparency obligations. The investigation, launched ex officio in February 2020, followed complaints lodged by several European consumer organisations, including the European Consumer Organisation (BEUC).
The DPC opened its inquiry into Google's location data processing practices in 2020, following complaints from several European consumer rights organizations. As reported by the DPC, these complaints specifically related to Google's processing of location data in connection with various services and products offered by the tech giant. The investigation examined "Web and App Activity," "Location History," and "Location Accuracy" between May 2018 and February 2020. Web & App Activity is a Google account setting that allows the company to process information related to users' activity on Google services, including browsing history, search history and location data. Location History, which requires users to opt in, tracks locations from compatible mobile devices and can use the data to infer places visited, activities and routes. Location Accuracy is an Android feature that enables devices to determine location more accurately by using inputs beyond the device's GPS unit. The decision concludes an inquiry that was opened in 2020 by the Irish Data Protection Commission (DPC), following complaints from consumer organizations across the EU over how Google processed people's location data and the transparency around that processing.
According to DPC Deputy Commissioner Graham Doyle, the investigation revealed that Google's failures allowed individuals to remain unaware that their location data was being used to influence them through targeted advertising or to infer their interests. The commission noted that the retention of users' location data for longer than necessary further aggravated this loss of control over personal data. As reported by the DPC, location data is considered particularly sensitive because it can be used to reveal details about users' personal lives, from religious beliefs and health conditions to political opinions. The tech giant infringed the EU's General Data Protection Regulation through its handling of user location data. The DPC has criticised Google for several breaches, including failing to comply with the requirements of lawfulness and fairness in relation to the data processed in "Web & App Activity" and "Location History" and not being able to demonstrate compliance with the principles of lawfulness, fairness and transparency regarding "Location Accuracy". The regulator also notes a lack of transparency in the three features examined.
The latest findings reveal that regulators also found the company failed to be lawful, fair and transparent when it processed personal data in its Location Accuracy feature in the Android mobile operating system. This represents a significant expansion of the original violations, as the investigation now covers not only Google's web-based services but also its mobile operating system's core location features. As reported by the DPC, location data is a type of personal data that's collected by Google and can be used to infer someone's location, making it particularly sensitive information that requires careful handling under EU privacy regulations. Location Accuracy is an Android feature that enables devices to determine location more accurately by using inputs beyond the device's GPS unit, and is available to Android users irrespective of whether they hold a Google Account.
Google has been given six months to address the issues and may appeal elements of the decision. The company stated that the case centres around 'historical policies' that have since been updated. A Google spokesperson said: "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple." The company now allows users to delete their data automatically once a certain period has expired, between three and 36 months. Google also stores location data that populates the Timelines feature on Google Maps on users' devices, and has simplified the management of how personal data is used for ad personalisation. At €403 million, this decision ranks just behind the €405 million fine imposed on Instagram in 2022. The two highest fines imposed by the DPC remain the €1.2 billion fine against Meta in 2023 and the €530 million fine against TikTok in 2025. Alongside the financial penalty, the DPC has ordered Google to bring its location-data processing practices into full compliance with the GDPR within six months.
The European Consumer Organisation, BEUC, which submitted one of the complaints to the DPC, welcomed the decision. Agustín Reyna, director general of BEUC, stated: "The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples' location data." However, BEUC expressed concerns about the time needed to come to this conclusion, noting that late enforcement can be as harmful as no enforcement at all. The decision emphasizes that under the EU's General Data Protection Regulation (GDPR), the processing of such data must be lawful, fair and transparent. This case does not mark the end of the dispute between the Irish regulator and Google. The DPC states that three other large-scale statutory investigations concerning the group remain open, all at an advanced stage. As Deputy Commissioner Graham Doyle noted, 'Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.'
