Irish Regulator Fines Google €403 Million Over Location Data Processing

Ireland's Data Protection Commission (DPC) has fined Alphabet's Google €403 million ($463 million) following a multi-year inquiry into the company's handling of user location data. The regulator concluded that Google infringed European Union privacy rules under the General Data Protection Regulation (GDPR) between May 2018 and February 2020.

The DPC investigation, which began in 2020 after complaints from several European consumer rights organizations, focused on three specific Google features: Web & App Activity, Location History, and Location Accuracy. The regulator found that Google failed to meet lawfulness, fairness, and transparency obligations, and that it retained location data for longer than necessary. DPC Deputy Commissioner Graham Doyle stated that users were often unaware their location was being used to infer interests or influence them with advertisements, leading to a loss of control over their personal data.

Google transitioned Location History to on-device Timeline storage with optional end-to-end encrypted backups and a three-month default retention window, eliminating server-side access to location logs. For Android Location Accuracy, modern versions introduced explicit toggles allowing users to restrict third-party apps to approximate location rather than precise coordinates.

Google has been ordered to bring its data processing practices into compliance within six months. A spokesperson for the company noted that the case centered on historical policies that have since been updated. According to the company, it has evolved its practices significantly since 2019, introducing tools that allow users to automatically delete personal data on a rolling basis, store timeline data directly on their devices, and manage how location information is utilized for advertising. Google also stated that it now stores an estimated general area rather than precise device location for search queries.

Google instituted default eighteen-month auto-deletion, granular deletion controls, and general area estimation rather than precise device coordinates during searches. An ongoing inquiry opened under the Data Protection Act investigates Google's online Ad Exchange and Real-Time Bidding system regarding transparency, data minimization, and retention practices.

This penalty marks the fourth-largest fine levied by the Irish DPC since it became the lead EU regulator for major US technology firms under the 2018 GDPR framework. The commission has collected over €4 billion in total fines during this period. While this inquiry has concluded, the DPC confirmed that three other large-scale statutory inquiries into Google remain ongoing and are currently at an advanced stage. Consumer advocacy groups, including the European Consumer Organisation (BEUC), welcomed the ruling but criticized the six-year duration of the investigation, arguing that delayed enforcement can diminish the impact of privacy protections.