Google has been fined €403 million, about US$463 million, by Ireland’s Data Protection Commission after a GDPR inquiry into how Google processed location data across several account and Android features.
The DPC announced the decision on September 21, 2026. The inquiry covered Google’s processing of location data in Web & App Activity, Location History and Location Accuracy from May 25, 2018, when the GDPR became applicable, to February 4, 2020.
The ruling is not a blanket finding that location services are unlawful. It focuses on how Google processed, explained and retained location data under European privacy law.
The DPC found problems with lawfulness, transparency and retention
Ireland’s regulator said Google infringed the GDPR in several ways. The findings included the lawfulness and fairness of location data processing in Web & App Activity and Location History, transparency obligations across all three features, retention of location data in Web & App Activity and Location History, and accountability obligations connected to Location Accuracy.
The DPC imposed administrative fines totalling €403 million and ordered Google to bring the relevant processing into compliance within six months. The regulator said it will publish the full decision in due course.
The case began as an own-volition inquiry launched in February 2020. The DPC said it opened the inquiry after receiving complaints from several European consumer rights organisations, including BEUC, about Google’s processing of location data.
Why location data drew such close scrutiny
Location data can make services more useful, from maps and local search to weather, navigation and nearby recommendations. The same data can also expose patterns that reach far beyond a single pin on a map.
Deputy Commissioner Graham Doyle said location data can reveal information that is “inherently private.” The DPC also said people could have been unaware that their location data was being used to influence ads or infer interests, and that keeping the data longer than necessary aggravated that loss of control.
BEUC, which coordinated the consumer organisation complaint activity, described geolocation data as one of the most invasive forms of commercial surveillance. It said the 2018 complaints involved consumer organisations from Norway, The Netherlands, Greece, Czech Republic, Slovenia, Poland, Sweden and Denmark.
The three Google features at the centre of the case
The DPC’s announcement gave separate descriptions for each of the features involved in the inquiry.
- Web & App Activity: A Google account setting that can process information about activity on Google services, sites and apps. The DPC said this information can include browsing history, search history and location data.
- Location History: A Google service that keeps track of a user’s location while using compatible mobile devices. The DPC said it can infer place visits, activities and paths between places, and can display a private map through Google Maps Timeline.
- Location Accuracy: An Android feature that allows a device to determine location more accurately than relying only on GPS. The DPC said it is available to Android users whether or not they hold a Google account.
Those distinctions matter because privacy controls are often spread across account settings, device settings and app-level permissions. The regulator’s findings point to a broader issue for large platforms: privacy compliance is not only about offering toggles, but also about explaining what those toggles do, proving a lawful basis for processing and limiting how long data is kept.
Google says the case involves older policies
Google said the case centred on historical policies that have since been updated. In a statement reported by the Associated Press and other outlets, the company said it had significantly changed its practices from 2019 onward and launched tools to make location data easier to manage.
That response does not erase the regulator’s findings for the period examined. It does, however, frame the case around older product and policy designs rather than Google’s current location-data controls.
The DPC’s full decision, once published, should provide more detail on the legal reasoning, the fine calculation and the specific compliance steps Google is expected to take.
The fine may not be collected immediately
The headline number is large, but DPC fines do not become payable the moment they are announced. The DPC’s general fines guidance says fines must be confirmed by a court before they are payable. If a company appeals, the fine cannot be collected while that appeal is pending.
That process helps explain why major GDPR penalties can take years to move from announcement to collection. The DPC’s fines page says more than €4 billion in fines had been levied through DPC inquiries as of its last listed update, while about €20 million had been collected.
Why the case matters beyond Europe
The decision applies under European privacy law, but its message reaches beyond the EU and EEA. Large technology companies often build product controls for global platforms, and privacy enforcement in one major market can affect design choices elsewhere.
For consumers, the case is another reminder that location settings can be layered. A map timeline setting, account activity setting, device-level location feature and app permission may not all control the same data flows.
For businesses, the case reinforces the need to document why data is collected, how consent or another lawful basis is obtained, how privacy information is presented, and how long data is retained. Those records matter most when a regulator asks a company to prove compliance after the fact.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
