Google Fined €403 Million Over How It Handled Location Data
Ireland's Data Protection Commission has fined Google Ireland Limited €403 million for infringements of the GDPR, the EU's general privacy law, in its processing of location data. The Commission published its final decision on 21 September 2026. DPC announcement
The decision was made by Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney. The Commission acted as Lead Supervisory Authority for Google, meaning it led the case and issued the decision on behalf of the European Union. Barron's
The Commission opened the inquiry on its own volition in February 2020. It acted after complaints from European consumer rights organisations including BEUC. The scope was narrow. It covered three distinct processing operations, or three separate data pipelines: Web & App Activity, Location History and Location Accuracy. The period under examination ran from 25 May 2018 to 4 February 2020.
On the substance, the Commission assessed each pipeline against separate GDPR principles. For Web & App Activity and Location History, it found infringements relating to lawfulness and fairness, in short whether Google had a valid legal basis and whether users could reasonably expect the processing. For transparency, the duty to clearly explain what data is collected and why, it found breaches for all three operations: Web & App Activity, Location History and Location Accuracy.
For Location Accuracy, the Commission also found a failure to demonstrate compliance with lawfulness, fairness and transparency, which it treated as a breach of accountability, the obligation to document and prove compliance. A further finding concerned storage. Google breached retention rules for location data held in Web & App Activity and Location History by keeping data too long.
The penalty is administrative fines totalling €403 million, equivalent to $462 million. The Commission also ordered Google to bring its processing into compliance within six months. The order has a deadline. Reuters
In my view, the structure of the decision is the point that will matter most to engineering and compliance teams. Lawfulness, transparency, accountability and retention were treated as separate checks, and each of the three location pipelines was judged on its own. A fix in one settings flow does not automatically fix the others. That work is difficult, since it touches collection, inference, logging and deletion in current systems, but it leaves location features that are easier to audit, explain and maintain for users and business customers.
