Irish watchdog fines Google €403m over location data handling

Overview

Updated Sep 21

Ireland's Data Protection Commission fined Google Ireland €403 million ($463 million) on Monday, ending a six-year investigation into how the company processed users' location data. The watchdog found Google breached the EU's General Data Protection Regulation on four counts across three features: Web & App Activity, Location History, and Location Accuracy.

The ruling covers data processed between May 2018 and February 2020. Regulators concluded Google's practices were neither lawful, fair, nor transparent — and that individuals could have been unaware their location was being used to influence them with ads or infer their interests. Google has six months to bring its processing into compliance, or face further action.

Why it matters

If the fine stands, Google must rework how it gets consent for location data across Europe — a core input to ad targeting and footfall measurement worth billions.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

€403M

Fine imposed on Google Ireland

Equivalent to $462.9 million at current exchange rates; among the largest penalties the DPC has issued.

6 years

Length of DPC investigation

Opened February 2020 following complaints from European consumer rights organizations.

6 months

Deadline for GDPR compliance

Google must bring data processing into compliance or risk further enforcement.

GDPR violations found

Breaches of lawfulness, fairness, transparency, and retention rules across three features.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Des Hogan

Data Protection Commissioner, Ireland

Co-signatory of the DPC decision against Google

Dale Sunderland

Data Protection Commissioner, Ireland

Co-signatory of the DPC decision against Google

Niamh Sweeney

Data Protection Commissioner, Ireland

Co-signatory of the DPC decision against Google

Graham Doyle

Deputy Commissioner, DPC

Spokesperson for the decision

Agustin Reyna

Director General, BEUC

Welcomed the decision

Organizations Involved

Data Protection Commission (DPC)

National independent authority

Imposed the €403m fine on Google Ireland

Ireland's independent authority for upholding data protection rights under the GDPR.

Google Ireland Limited

Technology company

Fined €403m; ordered to comply within six months

Google's Dublin-based European entity and the subject of the DPC's enforcement action.

BEUC (European Consumer Organisation)

Consumer advocacy umbrella group

Filed the original complaints that triggered the investigation

Brussels-based umbrella group for 42 consumer organizations across 31 countries.

Timeline

May 2018 September 2026

6 events Latest: September 21st, 2026 · 2 months ago

Tap a bar to jump to that date

September 2026
DPC fines Google €403m for GDPR violations
Latest Enforcement

Ireland's DPC issues its final decision, finding Google breached GDPR on four counts related to location data processing between May 2018 and February 2020.
September 21st, 2026
July 2026
European Commission fines Google €890m under DMA
Legal

The European Commission imposes a separate €890 million fine on Google under the Digital Markets Act, giving the company 60 days to comply.
July 23rd, 2026
December 2023
Google announces Maps Timeline changes
Product Change

Google details plans to move history storage onto devices and cut default retention from 18 months to 3 months, part of broader data minimization efforts.
December 2023
February 2020
DPC opens own-volition inquiry
Investigation

Ireland's Data Protection Commission launches a formal inquiry into Google's processing of location data in Web & App Activity, Location History, and Location Accuracy.
February 2020
November 2018
Consumer groups file coordinated complaints
Complaint

BEUC coordinates complaints from consumer organizations in 8 European countries over Google's location data practices, filed with the DPC.
November 2018
May 2018
GDPR takes effect across the EU
Regulatory

The General Data Protection Regulation becomes enforceable, creating strict data privacy and security rules across the European Union and triggering the consent regime under scrutiny in this case.
May 25th, 2018

Scenarios

Google Appeals the Fine, Compliance Deadline Slips

Possible Resolves by Mar 21, 2027

Discussed by: MLex, legal analysts following the DPC's enforcement record

Google has not said publicly whether it will challenge the decision. If it follows the path of TikTok — which appealed a DPC transfer order and obtained a conditional stay from Ireland's High Court in November 2025 — the six-month compliance deadline could effectively be paused while litigation proceeds. The DPC's decision text has not been published, which means the full scope of required changes remains unclear.

Google Complies Within Six Months, Fine Stands

Possible Resolves by Mar 21, 2027

Discussed by: DPC statement, Google's public response noting policies were already updated

Google's response emphasized that the case concerns historical policies updated since 2019, including auto-delete controls and increased transparency measures. If the DPC accepts that current tools — device-stored Maps Timeline history, rolling auto-delete, and simplified ad controls — already satisfy the compliance order, Google could meet the six-month deadline without major product changes. The fine stands as the largest DPC penalty against Google but may not require structural changes.

Subsequent Fines Follow as GDPR Enforcement Escalates

Uncertain Resolves by Jun 21, 2027

Discussed by: BEUC director general Agustin Reyna, who criticized slow enforcement and called for faster GDPR remedies

Reyna's criticism of the eight-year gap between complaints and resolution signals that consumer groups may push for quicker, more aggressive enforcement. If the DPC finds ongoing violations in its compliance review — particularly around ad targeting and store visits measurement, which rely on location data — additional fines could follow. The same-day announcement of the €890m DMA fine suggests regulators are coordinating pressure on Google across multiple legal frameworks.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

September 2025 – November 2025

TikTok's DPC transfer order (2025)

Ireland's DPC fined TikTok €345 million and ordered it to suspend transfers of user data to China within six months. TikTok appealed to Ireland's High Court, which granted a conditional stay in November 2025, pausing the suspension order while the case proceeds.

Then

The suspension order is not being enforced while litigation continues, setting a precedent for how DPC deadlines interact with appeals.

Now

The case established a template for tech companies contesting DPC compliance deadlines through Irish courts.

Why this matters now

Google's six-month compliance deadline could follow the same path if the company appeals. TikTok's successful stay demonstrates that DPC deadlines are not absolute when challenged in court.

July 2026

European Commission's DMA fine on Google (July 2026)

The European Commission fined Google €890 million under the Digital Markets Act and gave the company 60 days to comply, a deadline that fell on the same day as the DPC announcement. Google removed free shopping listings from search results across the EEA under that regime.

Then

Google faced two major financial penalties from EU authorities in the same quarter, under two different legal frameworks.

Now

The dual enforcement signals coordinated pressure on Google from both competition and privacy regulators in Europe.

Why this matters now

Shows that Google is simultaneously navigating multiple EU regulatory regimes. The DPC fine and the DMA penalty landed on the same day — an indication of compounding regulatory exposure.

2022 – 2025

DPC's record GDPR fines on Big Tech (2022–2025)

The DPC issued some of the largest GDPR fines in history, including a record €1.2 billion against Meta in 2023 for transferring EU user data to the US, and a €405 million fine against Meta in 2022 over children's data on Instagram.

Then

These fines established the DPC as Europe's primary enforcer of GDPR against Big Tech, given Dublin's role as lead authority for major platforms.

Now

The DPC's enforcement record shows a pattern of large penalties followed by compliance orders that companies often appeal.

Why this matters now

The Google fine follows an established pattern of DPC enforcement. Whether Google appeals will determine if this becomes another multi-year legal battle or a rare acceptance of a DPC ruling.