Ireland fines Google €403m over location data in first major penalty against the company

What the regulator decided

The fine, about $463 million, is the fourth-largest the DPC has issued and its first major penalty against Google, POLITICO reported. It forms part of more than €4 billion in fines the DPC has imposed since the GDPR took effect in 2018, a total that includes a €1.2 billion penalty against Meta, almost three times the size of the Google fine.

Alongside the money, the DPC ordered Google to bring its processing of location data into compliance within six months, Reuters reported. The fine cannot be collected until an Irish court confirms it, and Google can appeal to the High Court within 28 days of formal notice, the DPC said. Google said the case centres on historical policies that have since been updated. A spokesperson told Reuters the company intends to appeal to "obtain greater legal clarity on a few specific points."

The findings cover conduct that ended in February 2020.

Why ad targeting sits at the centre

The DPC found breaches of the GDPR rules on lawful and fair processing, and on transparency, for Web & App Activity and Location History. It also found Google kept location data longer than necessary through those two features. DPC Deputy Commissioner Graham Doyle said individuals could have been unaware their location was being used, for example, to influence them with ads or to infer their interests, and could lose control of their personal data.

For Location Accuracy, an Android feature available with or without a Google account, the findings were narrower. Google failed transparency and accountability duties there because it could not show the processing was lawful, fair and transparent.

The DPC has not said publicly which processing its compliance order covers. It says the full decision will be published later.

What Google says it already changed

In May 2019, inside the period examined, Google announced auto-delete controls for Location History and Web & App Activity. Users could delete that data after 3 or 18 months. In June 2020 it made 18-month auto-delete the default for Web & App Activity on new accounts and for anyone turning on Location History for the first time.

In December 2023 Google said Timeline, the Maps view of Location History, would keep its data on users' devices. First-time Location History users would get a 3-month auto-delete default. Google said that from 2019 onwards it significantly evolved its practices and launched tools to manage location data. The DPC has not publicly said whether those changes are sufficient to meet its order.

Six and a half years from inquiry to decision

The DPC opened the inquiry in February 2020 after complaints from European consumer groups including BEUC. BEUC's member groups had filed with national authorities in November 2018. The period examined ran from 25 May 2018, when the GDPR took effect, to 4 February 2020, the day the DPC announced the inquiry.

The decision came more than 6.5 years after the inquiry opened. BEUC director general Agustín Reyna welcomed it but criticised the delay: "Late enforcement can be as harmful as no enforcement at all," he said.

What happens next

The DPC has three other formal investigations into Google open, covering its PaLM2 AI model, its personalised advertising system and its account registration process. The regulator says all three are in their final stages.