Google faces €403 million EU fine over location data and privacy rules

Yesterday 23:55

Google has been hit with a €403 million fine by Ireland’s Data Protection Commission (DPC) over the way it handled users’ location information, bringing renewed attention to the transparency and consent requirements imposed by European data-protection rules.

The decision, announced Monday, is the fourth-largest penalty issued by the Irish regulator. The DPC acts as Google’s lead European privacy authority because the technology company’s European headquarters are based in Dublin.

The case focuses on several Google services and settings connected to the collection and use of location information. Regulators examined whether users were adequately informed about how their location data could be processed and whether the consent mechanisms complied with the General Data Protection Regulation (GDPR).

Location data under closer scrutiny

Location information can provide companies with detailed insights into people’s movements and habits. According to the DPC, such data can improve the functionality of digital services but can also reveal highly personal information about individuals.

Graham Doyle, deputy commissioner at the DPC, said the investigation found shortcomings that could have left users unaware of how their location information was being used, including for advertising-related purposes or to infer interests.

The case therefore goes beyond the technical management of GPS or location settings. It raises broader questions about whether users have sufficient control over information capable of revealing patterns in their daily lives.

Under the GDPR, companies operating in Europe must provide clear information about personal-data processing and obtain consent under defined conditions when consent is the appropriate legal basis.

Google given six months to adjust its practices

Following the ruling, Google has six months to bring the practices covered by the decision into compliance with European data-protection requirements.

The regulatory process examined three key areas of Google's ecosystem: Web & App Activity, Location History and Location Accuracy.

The investigation followed complaints coordinated in 2018 by the European consumer organisation BEUC and several national consumer groups. Complaints were filed in countries including Norway, Greece, the Czech Republic, Slovenia, Poland, Sweden and the Netherlands.

The DPC formally opened its investigation in February 2020, focusing on whether Google’s approach to location-data processing met the requirements of European privacy law.

Consumer groups criticize the length of the procedure

Consumer organisations welcomed the decision but criticized the time it took to reach a conclusion.

Agustín Reyna, director general of BEUC, stressed the sensitivity of location information, noting that it can reveal details about people's movements and visits to places such as schools, hospitals and places of worship.

BEUC argued that the lengthy process weakened the practical impact of data-protection rules. The organisation said that stronger enforcement needs to be accompanied by faster procedures when fundamental consumer rights are at stake.

The criticism highlights a wider issue facing European digital regulation: the ability of supervisory authorities to process complex investigations quickly enough to keep pace with technology companies whose services and data practices evolve rapidly.

Google points to changes made since 2019

Google said the case concerns historical policies that have since been changed.

A company spokesperson said Google had significantly modified its practices since 2019 and introduced tools intended to make the management of location information easier for users.

The company’s response underscores the distinction between the practices examined by the regulator and Google's current privacy controls. The DPC's decision nevertheless requires the company to address the compliance issues identified in the case within the six-month deadline.

Three other DPC investigations remain ongoing

The latest penalty is not the only regulatory matter involving Google and the Irish authority.

The DPC said three other investigations involving the technology company are currently at an advanced stage.

One of the cases, launched in September 2024, examines whether Google should have carried out a data-protection impact assessment before using Europeans’ personal information in connection with the training of its artificial-intelligence systems.

The development illustrates how European regulators are increasingly examining the data practices behind artificial intelligence, alongside more established areas such as advertising, location services and international data transfers.

A significant case in Europe’s privacy landscape

The €403 million penalty adds another major chapter to Europe's efforts to enforce the GDPR against large technology companies.

The Irish regulator's largest-ever fine was imposed on Meta in 2023, when the company was ordered to pay €1.2 billion over the transfer of European users’ data to the United States.

For Google, the location-data ruling puts the practical question of user consent back at the centre of the debate. It also reinforces the broader principle that companies must make the processing of sensitive personal information understandable to the people whose data they collect.

As the six-month compliance period begins, attention will now turn to the measures Google takes to address the regulator's findings and to the outcome of the DPC's other investigations.