Ireland's Data Protection Commission fined Google €403 million, about $463 million, over how it processed location data through three features: Web & App Activity, Location History, and Location Accuracy. The regulator also ordered Google to bring its processing into compliance with GDPR within six months.
The decision covers processing between May 25, 2018, and Feb. 4, 2020. The DPC opened its own-volition inquiry in February 2020 after receiving complaints from several European consumer rights organizations. That historical window is what regulators examined, not a ruling that Google's current settings operate in exactly the same way today.
The complaints that triggered the case came from consumer organizations in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia, and Sweden, filed in November 2018 and coordinated by BEUC. Google says its practices have changed substantially since 2019. BEUC says its members believed the underlying deceptive-design problems were not fully resolved and filed another complaint in 2022.
Google Web & App Activity, Location History, and Location Accuracy violations
The DPC's Sept. 21 decision found that Google's processing of location data through Web & App Activity and Location History infringed GDPR's lawfulness and fairness requirements.
Location Accuracy received a different finding. The DPC said Google breached its accountability obligations because it failed to demonstrate compliance with the principles of lawfulness, fairness, and transparency for personal data processed through that feature.
All three features were also found to breach GDPR transparency requirements. Web & App Activity and Location History were separately cited for retaining location data longer than necessary.
The decision was made by Commissioners Dr Des Hogan, Dale Sunderland, and Niamh Sweeney.
The consumer complaints behind the inquiry alleged that Google's interfaces pushed Android users toward allowing continuous location tracking. BEUC says the complaints were based on research by Norwegian consumer organization Forbrukerrådet documenting deceptive design, misleading information, and repeated prompts intended to encourage location tracking.
DPC Deputy Commissioner Graham Doyle said Google's failures could leave people unaware that their location information was being used to influence advertising or infer interests, reducing their control over personal data. He added that keeping location data longer than necessary aggravated that loss of control.
The €403 million penalty is the fourth-largest fine issued by the Irish regulator, according to AP. The DPC's current fines register says it has imposed more than €4.4 billion in fines through its inquiries since GDPR took effect.
Google's response and BEUC's dispute
Google says the case concerns historical practices.
A company spokesperson told reporters that the investigation centered on policies that have since been updated and said Google has substantially changed its location-data practices and management tools since 2019.
Some of those changes are visible in Google's current documentation.
Google now calls Location History Timeline. When Timeline is enabled, precise device location is saved on the device, and users can optionally store an encrypted backup on Google's servers. Timeline is off by default, and Google allows users to automatically delete Timeline data older than three months, 18 months, or 36 months.
Google's current documentation on Web & App Activity needs more careful wording than some of the reporting around the fine suggests. The setting can save information about a user's general area and IP address. Google also says precise location can be stored as part of activity when that activity itself involves a precise location.
That means it would be too broad to say Web & App Activity categorically no longer stores precise device location.
Those current product descriptions do not change what the DPC found about Google's processing between May 2018 and February 2020. The regulator's full written decision has also not yet been published, so its complete legal reasoning and the precise changes required under the six-month compliance order are not yet public.
BEUC takes a less settled view of Google's changes.
The organization says Google altered its platform globally after the original complaints but that BEUC and several members filed a second complaint in 2022 because they believed deceptive-design problems had not been sufficiently resolved.
BEUC Director General Agustín Reyna welcomed the ruling while criticizing how long enforcement took. BEUC describes geolocation data as particularly sensitive because movement patterns can reveal details about matters such as health, religion, political activity, and other aspects of private life.
Google also faces three additional DPC investigations that AP reports are at an advanced stage. The regulator has not publicly detailed those cases.
What the ruling does not establish yet
The DPC says it will publish the full decision in due course. As of Oct. 2, its public record still consists of the Sept. 21 announcement rather than the full written ruling.
That announcement clearly establishes four categories of GDPR infringement during the investigated period: lawfulness and fairness failures for Web & App Activity and Location History, an accountability failure involving Location Accuracy, transparency failures affecting all three features, and excessive retention involving Web & App Activity and Location History.
What the public summary does not provide is account-by-account information showing which specific users were affected or the complete remedial steps Google must take under the six-month compliance order.
It also should not be read as a technical description of Google's current products. Timeline and Google's other location controls have changed substantially since the period examined by the regulator.
Users can currently review Timeline, Web & App Activity, and related location controls through their Google Account. Google notes that turning off Timeline does not necessarily prevent all location information from being saved elsewhere: Web & App Activity and other settings can still include location information such as a device's general area and IP address.
The next major development in the enforcement case will be publication of the DPC's full decision, which should provide the detailed legal reasoning and clarify exactly what Google must change to satisfy the compliance order.
Comments
Be the first, drop a comment!