Google Fined €403 Million for Handling Location Data the Wrong Way

Ireland's Data Protection Commission has fined Google Ireland Limited €403 million for breaking EU privacy rules on location data. The Commission published its final decision on 21 September 2026. DPC announcement

The decision was made by Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney. The Commission acted as Lead Supervisory Authority for Google, meaning it handled the case for the European Union. Barron's

The Commission started the inquiry itself in February 2020. It acted after complaints from European consumer groups including BEUC. The scope was narrow. It looked at three Google settings: Web & App Activity, Location History and Location Accuracy. The period examined ran from 25 May 2018 to 4 February 2020.

For Web & App Activity and Location History, Google broke the rules on lawfulness and fairness. That is about having a proper legal reason and treating people fairly. For openness, the finding was wider. Google broke transparency rules, the duty to clearly explain what it does, for all three settings.

For Location Accuracy, Google also could not show it had met the rules on lawfulness, fairness and openness. The Commission treated that as a breach of accountability, the duty to keep records and show its work. Google also broke retention rules by keeping location data too long in Web & App Activity and Location History.

The penalty is fines totalling €403 million, equivalent to $462 million. The Commission also ordered Google to fix its processing within six months. The order has a deadline. Reuters

In my view, the six-month fix matters more than the fine for what happens next. The fine looks back at 2018 to early 2020. The fix has to work in today's systems that collect, guess, log and delete location data. That is hard work, but it can leave users with location features that are easier to understand and trust.