Google Location Data Fine: Ireland's DPC Orders €403 Million Penalty
The Google location data fine issued by Ireland's Data Protection Commission comes to €403 million, about $463 million, according to Reuters. The penalty, announced on 21 September 2026, is the fourth-largest the regulator has imposed. Google Ireland Limited has also been ordered to bring the processing at issue into compliance within six months.
The DPC is the lead privacy regulator for Google across the European Union and the European Economic Area, so a decision taken in Dublin carries weight well beyond Ireland. Reuters reported that the investigation opened in February 2020 and covered the company's practices from 25 May 2018, the day the GDPR took effect, through 4 February 2020.
Three Settings Behind the Google Location Data Fine
Regulators narrowed the case to three Google features, each producing a different set of failures under EU privacy law.
| Feature | What the DPC found |
|---|---|
| Web & App Activity | Location data processed unlawfully and unfairly |
| Location History | Location data processed unlawfully and unfairly |
| Location Accuracy | Breaches of transparency and accountability duties |
| Retention, all features | Location data kept longer than necessary, treated as an aggravating factor |
The DPC's central conclusion is that Google had no valid basis for processing location data through Web & App Activity and Location History, and that the processing failed the GDPR's fairness test as well. On Location Accuracy, the regulator found gaps in what Google told users and in the records it kept to show compliance. Retaining location data beyond the period needed counted against the company when the penalty was set.
Location Accuracy is the least visible of the three. Help Net Security noted that it governs how Wi-Fi networks, Bluetooth beacons and device sensors sharpen an estimated position beyond what satellite signals alone provide. The DPC treated the way Google explained that processing, and the way it documented its own compliance, as failures separate from the underlying collection.
Web & App Activity and Location History are separate controls that overlap in practice. The first logs searches, browsing and app usage tied to an account, while the second builds a timeline of places visited. The DPC found that location data flowed through both without a lawful basis, which matters for anyone who switched one off and assumed the other covered the same ground.
The case traces back to consumer organisations rather than a single individual's complaint. The Guardian reported that groups in seven European countries filed objections in November 2018, arguing that Android owners and Google account holders were steered into enabling tracking without a clear picture of how their whereabouts would feed advertising and interest profiling.
The DPC accepted that framing. Its findings state that people could have been unaware their location was being used to target them with ads or to infer their interests, and that they risked losing control of their personal data. Research examined during the inquiry indicated that location records can expose sensitive characteristics, including health status and political leanings.
Google's Position and the Compliance Order
Google does not contest the substance so much as the timing. The company says the decision covers older product policies it has already replaced, and that account holders now have clearer controls for reviewing and deleting their location data.
That position does not change the outcome. The compliance order attaches to the processing examined in the inquiry, and the six-month clock runs from the decision, placing the deadline in the first quarter of 2027. Failing to meet such an order is itself enforceable under the GDPR, which makes the order more consequential for Google's product design than the headline figure.
Meeting the order is not a matter of paying and moving on. Google has to show the DPC how the processing in scope now satisfies the lawfulness, fairness and transparency tests the regulator applied, and how long location records are kept. That documentation requirement is where the case is likely to have its longest tail.
The €403 million total, worth about £345 million, ranks fourth among the DPC's fines. The regulator's largest sanctions have centred on Meta, and its biggest cases have tended to concern advertising consent and international data transfers. Location tracking has played a smaller part in that record until now.
The inquiry window creates friction for both sides. Enforcement covers conduct that ended more than six years before the penalty was published, while Google's current settings and disclosures were not assessed in the decision. That gap leaves the compliance order as the main forward-looking element of the case, because it requires Google to show that the processing in scope now meets the standard the DPC applied.
Consumer organisations, rather than individual data subjects, supplied the initial evidence, and the inquiry that followed ran for roughly six years before concluding. That timeline is typical of the regulator's largest cases, which involve cross-border processing by companies using Ireland as their EU base. A DPC decision against one of those companies sets the template for how the same practices are treated across the European Economic Area.
What It Means for Users
No money flows back to users from an administrative fine of this kind, and the decision does not switch off any setting on an Android phone or Google account. What it does is set terms for how Google must explain, justify and limit the location data it retains for the period covered by the order.
Anyone who wants to review their own exposure can do so through the Google Account controls the company cites as its remedy. Web & App Activity, Location History and Location Accuracy each have their own toggles, and the DPC's findings turn on the fact that the link between those switches and advertising was not made obvious enough.
Why This Matters
The Google location data fine sets a marker for how European regulators will treat tracking that is technically disclosed but practically opaque. The penalty is retrospective, covering 2018 to 2020, yet the compliance order reaches forward and puts a deadline on how Google justifies the location records it keeps. For consumers, the six-month window is the part to watch: it determines whether clearer settings arrive as a real change in defaults or as another layer of explanation.
Related Articles
- Uber GDPR fine: €825M ruling on automated account bans
- EU AI Act Enforcement Is Underway: What Enterprises Face From August 2 [Update]
- EU AI Act enforcement, three weeks in: action count is zero [Update]
✔Human Verified
Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.