Ireland's Data Protection Commission announced Monday that it will impose a fine of more than €403 million (approximately $462 million) on Google for violations related to the processing of location data. The penalty concludes a probe that commenced in February 2020. The tech company must also remediate its data handling procedures within six months, as outlined in the regulator's statement. As Google's European operations are headquartered in Dublin, the DPC serves as the bloc's primary supervisory body responsible for overseeing the company's compliance with data protection rules.
The investigation originated more than six years ago when several European consumer advocacy organisations petitioned the DPC to examine Google's conduct, which they claimed breached the General Data Protection Regulation (GDPR). The inquiry concentrated on Google's handling of location information across three distinct services and functionalities: web and app activity, location history, and location accuracy. The regulator determined that Google's methods for tracking and storing this information contravened GDPR requirements.
The DPC's examination covered Google's data processing methods spanning from May 2018—when GDPR took effect—through February 2020. The investigation assessed whether Google's practices adhered to legal and fair processing standards and whether the company fulfilled transparency and accountability obligations mandated by GDPR. Regulators also scrutinised Google's retention of location data within its web and app activity and location history functions.
The regulator underscored the sensitive character of location information. According to DPC Deputy Commissioner Graham Doyle, "It can also reveal a significant amount of information about an individual, including information that is inherently private." The DPC noted that location data "by itself or in conjunction with other information an individual's location can be inferred."
The enforcement action highlights how Google's conduct left users potentially unaware of how their location was being leveraged. "As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," the press release stated. "The retention of users' location data for longer than necessary aggravated this loss of control."
Whether Google continues to engage in certain aspects of the contested data processing or has since modified its practices remains uncertain. This marks the first instance in which the DPC has sanctioned Google, though other major platforms including TikTok and Meta have faced multiple fines in the hundreds of millions. Google declined to provide comment when contacted.
