- Published on
Data Protection Commission fines Google €403M over processing of location data
- Authors
- Name
- DeepHorus
The Data Protection Commission (DPC) has fined Google Ireland Limited €403 million for violating the EU's General Data Protection Regulation (GDPR) in its handling of user location data. The penalty, announced on September 21, 2026, follows a two-year inquiry launched in February 2020, which was itself prompted by complaints from European consumer groups, including BEUC. The DPC, acting as the Lead Supervisory Authority for Google, examined the company's processing of location information across three specific services.
The investigation focused on Google's "Web & App Activity," "Location History," and "Location Accuracy" features. The period under review spanned from the GDPR's application date of May 25, 2018, to February 4, 2020. The DPC's decision was made by Commissioners Dr Des Hogan, Mr Dale Sunderland, and Ms Niamh Sweeney.
The DPC found that Google infringed the GDPR on multiple grounds. These included failures in the lawfulness and fairness of its data processing for "Web & App Activity" and "Location History." Google also violated its accountability obligations by failing to demonstrate lawful, fair, and transparent processing for the "Location Accuracy" feature.
Furthermore, the commission ruled that Google breached its transparency obligations concerning all three services. The company also failed to properly manage the retention of location data within "Web & App Activity" and "Location History." The total administrative fine of €403 million was imposed, and Google has been ordered to bring its processing operations into compliance within six months.
Deputy Commissioner Graham Doyle highlighted the dual nature of location data, noting it can enhance services but also reveal deeply private information. He stated that Google's failures could have left individuals unaware their location was being used to influence them with targeted advertisements or to infer their interests. This lack of awareness resulted in a loss of control over personal data.
The DPC emphasized that retaining user location data longer than necessary exacerbated this loss of control. The commission stated it was grateful for cooperation from peer supervisory authorities throughout the case. The full text of the decision is expected to be published in due course.
This significant fine underscores the strict enforcement of GDPR principles across the European Economic Area. It sends a clear message to large technology companies about the paramount importance of lawful, fair, and transparent data processing. Google now faces a critical six-month window to overhaul its location data practices to avoid further regulatory action.
