Irish privacy watchdog fines Google €403 million over historical location data violations
Ireland’s Data Protection Commission (DPC) has imposed a €403 million ($463 million) administrative fine on Google following a multi-year inquiry into how the search giant processed and retained user location data. The decision, issued by the EU’s lead privacy regulator for Google, concludes that the tech company breached multiple fundamental requirements under the General Data Protection Regulation (GDPR) regarding transparency, fairness, and lawfulness of data processing.
Core Regulatory Findings Across Key Google Features
The inquiry was initiated in February 2020 after consumer rights groups, including the European Consumer Organisation (BEUC), filed formal complaints regarding Google's location-tracking practices. The investigation scrutinized data collected between May 25, 2018, and February 4, 2020, focusing on three specific platform features:
Web & App Activity: The DPC found that location data collected through this setting, which is enabled by default for account holders, was processed unfairly and without adequate user transparency. Regulators noted that users were often unaware their location information was being gathered to infer personal interests and target personalized advertising.
Location History: The regulator determined that Google failed to lawfully and fairly process user movements gathered via mobile devices, highlighting that historical location trails were retained for periods longer than necessary, worsening a loss of user control over sensitive personal data.
Android Location Accuracy: Regulators cited transparency and accountability failures within the Android operating system feature, which uses network signals to refine GPS positioning. The DPC noted that Google failed to clearly inform users about how data was handled, even when individuals were not actively interacting with Google services.
Regulatory Order and Planned Legal Challenge
In addition to the financial penalty, the DPC issued a formal compliance order requiring Google to bring its location data processing practices into alignment with GDPR requirements within six months.
Commenting on the ruling, DPC Deputy Commissioner Graham Doyle emphasized the sensitive nature of location tracking: "Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including inherently private information."
Google announced its intention to appeal the ruling, arguing that the investigation targets historical practices that have since been overhauled. The company highlighted that since 2019, it has introduced auto-delete defaults, enhanced user controls, and updated its Timeline features to store location data locally on devices rather than centralized cloud servers.
