Google €403 Million GDPR Location Data Fine: DPC Findings

Ireland's Data Protection Commission fined Google €403 million ($463 million) this week over how it processed location data through three features: Web & App Activity, Location History, and Location Accuracy, according to BleepingComputer. The regulator also ordered Google to bring its processing into compliance with GDPR within six months.

The decision covers processing between May 25, 2018, and February 4, 2020. The DPC opened its investigation in February 2020 after receiving complaints from consumer rights groups, per Reuters via Euronext and BleepingComputer. That window is what regulators examined, not a ruling on how these settings function today.

The complaints that triggered the case came from consumer organizations in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia, and Sweden, filed in November 2018 and coordinated by BEUC, according to BEUC. Google says its practices changed starting in 2019. BEUC says its members believe the underlying problems were never fully resolved. Both accounts appear below, alongside what the DPC's ruling actually establishes.

Google Web & App Activity, Location History, and Location Accuracy violations

The DPC found that Google's processing through Web & App Activity and Location History failed to meet GDPR's lawfulness and fairness requirements, meaning the legal basis Google relied on to collect that data didn't hold up, according to France 24. Web & App Activity is an account setting tied to activity across Google services; Location History tracks a user's location through their mobile device, per Reuters via Euronext.

Location Accuracy got a narrower finding. The DPC said Google failed to demonstrate that its processing complied with GDPR principles, a different standard than the outright lawfulness failure applied to the other two features (BleepingComputer).

All three features were cited for insufficient transparency. Web & App Activity and Location History were separately flagged for retaining data longer than necessary, according to Politico. Ireland's three privacy commissioners, Des Hogan, Dale Sunderland, and Niamh Sweeney, signed off on the decision, which cited four separate GDPR infringements in total, per the same Politico report.

The consumer complaints behind the case alleged that Google's prompts and interface design pushed Android users toward enabling continuous location tracking. That claim is based on research published by Forbrukerrådet, the Norwegian consumer organization, which documented deceptive design, misleading information, and repeated pushing aimed at getting users to allow constant movement tracking, according to BEUC.

DPC Deputy Commissioner Graham Doyle said the practical effect was that "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data." He added that "the retention of users' location data for longer than necessary aggravated this loss of control," per BleepingComputer.

The €403 million penalty is the fourth largest fine the DPC has issued and its first major penalty against Google, according to Politico. It's a fraction of the €1.2 billion fine the DPC hit Meta with in 2023 over data transfers to the United States, and it adds to more than €4 billion in total fines the DPC has levied since GDPR took effect in 2018, as it serves as lead EU regulator for most major US tech firms based in Ireland, per Reuters via Euronext.

Google's response and BEUC's dispute

Google frames the case as settled history. A company spokesperson said the matter "centers around historical policies that have since been updated," adding that "from 2019 onwards, we've significantly evolved our practices and launched strong tools that make managing location data simple," according to Politico.

Two specific claims support that framing. Google says Maps Timeline data is now stored on the device and automatically deletes information older than three months, per BleepingComputer. Google also says Web & App Activity no longer stores precise device coordinates, saving an estimated general area instead. The supplied reports attribute both descriptions to Google directly; the DPC's full decision has not yet been published, so there's no regulator confirmation attached to either claim.

BEUC tells a different story about the intervening years. Google made changes to its platform globally after the 2018 complaints, according to BEUC, but BEUC and several of its members filed a second complaint in 2022 because they believed the deceptive-design problems hadn't been sufficiently resolved. BEUC has described geolocation data as one of the most invasive forms of commercial surveillance, arguing it can reveal religious beliefs, health conditions, political opinions, and sexual orientation, per France 24.

BEUC Director General Agustín Reyna called the ruling "an important decision, close to eight years after a series of complaints" were filed, saying it "confirms the illegality of the way the tech giant obtained consent to use peoples' location data," according to BEUC. He also criticized the delay itself: "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement," and "late enforcement can be as harmful as no enforcement at all," per France 24.

Google faces three additional DPC inquiries described as "at an advanced stage." The regulator hasn't disclosed what those cases concern, according to Reuters via Euronext.

What the ruling does not establish yet

The DPC has said it plans to publish its full decision but hasn't done so, according to BleepingComputer. Until that document is out, the detailed legal reasoning behind the fine and the exact scope of what compliance requires from Google over the next six months remain only partially visible from the statements regulators and Google have released so far.

The reporting available also doesn't say whether any specific person's account was affected, and the ruling doesn't retroactively confirm what happened to data collected between 2018 and 2020. That's a separate question from whatever Google says about its current practices.

For now, users can review their Web & App Activity, Location History, and Location Accuracy settings in their Google Account, but this ruling doesn't establish whether a specific account was affected or what historical data Google is required to change or delete. The next substantive update will be the DPC's full published decision.