Pull to refresh
Logo
Irish watchdog fines Google €403m over location data handling

Irish watchdog fines Google €403m over location data handling

Rule Changes

Six-year probe into Web & App Activity, Location History and Location Accuracy ends with GDPR violations on four counts

Today: DPC fines Google €403m for GDPR violations

Overview

Updated 1 hour ago

Ireland's Data Protection Commission fined Google Ireland €403 million ($463 million) on Monday, ending a six-year investigation into how the company processed users' location data. The watchdog found Google breached the EU's General Data Protection Regulation on four counts across three features: Web & App Activity, Location History, and Location Accuracy.

The ruling covers data processed between May 2018 and February 2020. Regulators concluded Google's practices were neither lawful, fair, nor transparent — and that individuals could have been unaware their location was being used to influence them with ads or infer their interests. Google has six months to bring its processing into compliance, or face further action.

Why it matters

If the fine stands, Google must rework how it gets consent for location data across Europe — a core input to ad targeting and footfall measurement worth billions.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

€403M
Fine imposed on Google Ireland
Equivalent to $462.9 million at current exchange rates; among the largest penalties the DPC has issued.
6 years
Length of DPC investigation
Opened February 2020 following complaints from European consumer rights organizations.
6 months
Deadline for GDPR compliance
Google must bring data processing into compliance or risk further enforcement.
4
GDPR violations found
Breaches of lawfulness, fairness, transparency, and retention rules across three features.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

People Involved

Organizations Involved

Timeline

May 2018 September 2026

6 events Latest: Today
Tap a bar to jump to that date
  1. Google announces Maps Timeline changes

    Product Change

    Google details plans to move history storage onto devices and cut default retention from 18 months to 3 months, part of broader data minimization efforts.

  2. Consumer groups file coordinated complaints

    Complaint

    BEUC coordinates complaints from consumer organizations in 8 European countries over Google's location data practices, filed with the DPC.

  3. GDPR takes effect across the EU

    Regulatory

    The General Data Protection Regulation becomes enforceable, creating strict data privacy and security rules across the European Union and triggering the consent regime under scrutiny in this case.

Scenarios

1

Google Appeals the Fine, Compliance Deadline Slips

Possible Resolves by Mar 21, 2027

Discussed by: MLex, legal analysts following the DPC's enforcement record

Google has not said publicly whether it will challenge the decision. If it follows the path of TikTok — which appealed a DPC transfer order and obtained a conditional stay from Ireland's High Court in November 2025 — the six-month compliance deadline could effectively be paused while litigation proceeds. The DPC's decision text has not been published, which means the full scope of required changes remains unclear.

2

Google Complies Within Six Months, Fine Stands

Possible Resolves by Mar 21, 2027

Discussed by: DPC statement, Google's public response noting policies were already updated

Google's response emphasized that the case concerns historical policies updated since 2019, including auto-delete controls and increased transparency measures. If the DPC accepts that current tools — device-stored Maps Timeline history, rolling auto-delete, and simplified ad controls — already satisfy the compliance order, Google could meet the six-month deadline without major product changes. The fine stands as the largest DPC penalty against Google but may not require structural changes.

3

Subsequent Fines Follow as GDPR Enforcement Escalates

Uncertain Resolves by Jun 21, 2027

Discussed by: BEUC director general Agustin Reyna, who criticized slow enforcement and called for faster GDPR remedies

Reyna's criticism of the eight-year gap between complaints and resolution signals that consumer groups may push for quicker, more aggressive enforcement. If the DPC finds ongoing violations in its compliance review — particularly around ad targeting and store visits measurement, which rely on location data — additional fines could follow. The same-day announcement of the €890m DMA fine suggests regulators are coordinating pressure on Google across multiple legal frameworks.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2022 – 2025

DPC's record GDPR fines on Big Tech (2022–2025)

The DPC issued some of the largest GDPR fines in history, including a record €1.2 billion against Meta in 2023 for transferring EU user data to the US, and a €405 million fine against Meta in 2022 over children's data on Instagram.

Then

These fines established the DPC as Europe's primary enforcer of GDPR against Big Tech, given Dublin's role as lead authority for major platforms.

Now

The DPC's enforcement record shows a pattern of large penalties followed by compliance orders that companies often appeal.

Why this matters now

The Google fine follows an established pattern of DPC enforcement. Whether Google appeals will determine if this becomes another multi-year legal battle or a rare acceptance of a DPC ruling.

September 2025 – November 2025

TikTok's DPC transfer order (2025)

Ireland's DPC fined TikTok €345 million and ordered it to suspend transfers of user data to China within six months. TikTok appealed to Ireland's High Court, which granted a conditional stay in November 2025, pausing the suspension order while the case proceeds.

Then

The suspension order is not being enforced while litigation continues, setting a precedent for how DPC deadlines interact with appeals.

Now

The case established a template for tech companies contesting DPC compliance deadlines through Irish courts.

Why this matters now

Google's six-month compliance deadline could follow the same path if the company appeals. TikTok's successful stay demonstrates that DPC deadlines are not absolute when challenged in court.

July 2026

European Commission's DMA fine on Google (July 2026)

The European Commission fined Google €890 million under the Digital Markets Act and gave the company 60 days to comply, a deadline that fell on the same day as the DPC announcement. Google removed free shopping listings from search results across the EEA under that regime.

Then

Google faced two major financial penalties from EU authorities in the same quarter, under two different legal frameworks.

Now

The dual enforcement signals coordinated pressure on Google from both competition and privacy regulators in Europe.

Why this matters now

Shows that Google is simultaneously navigating multiple EU regulatory regimes. The DPC fine and the DMA penalty landed on the same day — an indication of compounding regulatory exposure.

Sources

(10)