Ireland's DPC fined Google €403 million over location data

The decision

The penalty is the first the DPC has imposed on Google, The Record reported. The regulator also ordered Google to change the processing covered by the decision.

The DPC is Google's lead privacy regulator in the European Union because the company's European headquarters are in Dublin. Its decisions therefore reach across the bloc. The inquiry covered the period from 25 May 2018, when the GDPR took effect, to 4 February 2020.

What the DPC found

The DPC's three commissioners found four infringements across the three features, BetaNews reported. Processing through Web & App Activity and Location History failed the lawfulness and fairness standard. Location Accuracy failed the accountability standard because Google could not show it met lawfulness, fairness and transparency. All three features fell short on transparency, and Google kept data from the first two longer than necessary.

Graham Doyle, the DPC's deputy commissioner, said location data "can reveal a significant amount of information about an individual, including information that is inherently private." He said users could have been unaware their location was used "to, for example, influence them with ads or to infer their interests", and could lose control over their personal data. Retaining the data longer than necessary "aggravated this loss of control", he said.

The three features

Web & App Activity is an account setting that can store searches, browsing history and location data. Location History, now shown as Google Maps Timeline, records places visited and routes travelled, including when someone carries a device but is not using a Google service. Location Accuracy is an Android feature that combines GPS, Wi-Fi, mobile towers and sensors, and works without a Google account.

The DPC opened the inquiry in February 2020 after complaints from several European consumer rights organisations, including BEUC, the DPC said. More than six years passed before the decision.

Google's response

Google said in a statement: "This case centres around historical policies that have since been updated." It said its practices have "significantly evolved" since 2019 and that it has introduced tools to manage location data.

It pointed to auto-delete controls that let users remove data on a rolling three, 18 or 36-month basis. Google Maps Timeline data is now stored on the device, and data older than three months is removed automatically, BleepingComputer reported. Google also says it stores an estimated general area rather than a precise device location when someone searches. It says it has added simpler ad management tools that let users turn off personalised ads entirely. Its documentation says Timeline is off by default, though Google warns that turning it off does not necessarily stop location being saved through other settings.

Scale and next steps

The €403 million fine is the fourth-largest the DPC has issued. It is smaller than the DPC's €1.2 billion fine on Meta and its fines on TikTok. The penalty is part of more than €4 billion in total DPC fines since the regulator took on the GDPR lead role in 2018. The dollar value was reported at about $461 million to $463 million.

Three further statutory inquiries into Google remain open and are at an advanced stage, the DPC said. The regulator has promised to publish the full decision.