Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) over its handling of users’ location data. The regulator found multiple GDPR violations involving how Google processed, explained, and retained location information collected through several of its services.
The investigation covered Google’s practices between May 25, 2018 and February 4, 2020. It examined three features capable of processing location information: Web & App Activity, Location History and Location Accuracy.
Ireland’s DPC opened its investigation in February 2020 following complaints submitted by European consumer organizations. As Google’s European headquarters are located in Ireland, the Irish authority serves as the company’s lead regulator for many cross-border data protection matters in the European Union.
The regulator identified problems with the lawfulness and fairness of Google’s processing through Web & App Activity and Location History. It also found that Google failed to demonstrate compliance with GDPR requirements concerning personal data processed through Location Accuracy.
Transparency was another central issue. According to the DPC, Google did not provide users with sufficiently clear information about how location data was being handled across the three services. Regulators also concluded that some information collected through Web & App Activity and Location History was retained longer than necessary.
Location information can be particularly sensitive because repeated records of a person’s movements can reveal frequently visited locations, routines and interests. The DPC said Google’s practices could have left people unaware that their location information might be used to infer interests or influence the advertising they were shown.
The three Google features covered by the investigation serve different purposes. Web & App Activity can save activity across Google services, while Location History records places and routes associated with a user and can display them through Google Maps Timeline. Location Accuracy uses signals from multiple sources to improve positioning on Android devices.
Google disputes the significance of the findings for its current services. The company says the case concerns historical practices that have since been changed, pointing to measures introduced in recent years such as automatic deletion options, additional privacy controls and clearer information about location data.
Google plans to appeal the decision, meaning the dispute could continue through the courts. In addition to the €403 million penalty, the DPC has ordered the company to bring the affected processing into compliance with GDPR requirements within six months.
The regulator has not yet published the complete decision. A fuller explanation of its findings and the specific compliance measures required from Google is expected when the final ruling is released publicly.