Irish DPC Fines Google €403 Million for Location-Data GDPR Breaches
Ireland's Data Protection Commission has fined Google Ireland Limited €403 million for infringements of the GDPR in its processing of location data. The Commission published its final decision on 21 September 2026. DPC announcement
The decision was made by Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney. The Commission acted as Lead Supervisory Authority for Google, issuing the decision on behalf of the European Union. Barron's
The Commission opened the inquiry on its own volition in February 2020. It acted after complaints from European consumer rights organisations including BEUC. The scope was narrow. It covered three distinct processing operations: Web & App Activity, Location History and Location Accuracy. The period under examination ran from 25 May 2018 to 4 February 2020.
On the substance, the Commission separated its findings by operation and by GDPR principle. For Web & App Activity and Location History, it found infringements relating to lawfulness and fairness of location-data processing. For transparency, the finding was broader. Google breached transparency obligations for Web & App Activity, Location History and Location Accuracy. For Location Accuracy, the Commission also found a failure to demonstrate compliance with lawfulness, fairness and transparency, which it treated as a breach of accountability obligations. A further finding concerned storage. Google breached retention rules for location data held in Web & App Activity and Location History.
The penalty is administrative fines totalling €403 million, equivalent to $462 million. The Commission also ordered Google to bring its processing into compliance within six months. The order has a deadline. Reuters
Looking at what this means for engineering and compliance teams, the structure of the decision matters more than the headline figure. Lawfulness, transparency, accountability and retention were treated as separate control points, and the three location pipelines were assessed individually. A system can fail on one principle while passing on another, and a fix in one pipeline does not automatically remediate the others. For practitioners, that points to settings logic, user-facing disclosures, internal records of processing and retention enforcement as parallel workstreams rather than a single consent banner to patch.
In this author's view, the six-month compliance window is the operationally important part. Fines allocate liability for a closed historical window, here 2018 to early 2020. Remediation has to live in current production systems for collection, inference, logging and deletion. That is difficult work, but worth flagging as constructive. When lawfulness criteria, disclosure text, accountability documentation and retention schedules are aligned per data flow, location-dependent features become easier to audit, explain and maintain. The long-term payoff is systems that users and enterprise customers can trust with sensitive signals.
