Six years of investigation. Three specific features found unlawful. And a sizable penalty as the DPC’s commissioners watch Google navigate a separate €890 million DMA fight.
Ireland’s Data Protection Commission fined Google €403 million, following a six-year investigation into how the company processed users’ location data between May 2018 and February 2020. The DPC found Google infringed GDPR requirements through three specific features — Web & App Activity, Location History, and Location Accuracy — failing both the “lawfulness and fairness” standard and its transparency obligations. DPC Deputy Commissioner Graham Doyle said the violations meant users “may have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.” Google must bring its processing into compliance within six months.
What’s Happening & Why It Matters
Three Features, One Failure
The DPC’s findings target specific product mechanics rather than a general accusation of poor data practice. Location data collected through Web & App Activity, Location History, and Location Accuracy all failed the same test — users weren’t given clear enough information to understand how their location was being used. In some cases, that data was retained longer than necessary. Doyle was firm about why that retention compounds the harm: “The retention of users’ location data for longer than necessary aggravated this loss of control.”
The view changes depending on how you read the ruling. This isn’t a case about Google collecting location data at all — plenty of legitimate services require it. It’s a case about transparency and retention discipline, the same two pillars GDPR built its core compliance requirements around from the start.
The Fourth-Largest Fine
At €403 million, this ranks as the fourth-largest fine the DPC has issued since GDPR took effect in 2018 — a regulator that has, over that period, levied more than €4 billion in total penalties against major US tech firms headquartered in Ireland for EU purposes. As TF covered in EU Fines Google €890 Million for Favouring Its Own Apps and Google Loses Its Appeal Against a Record €4.1 Billion EU Fine, Google is navigating at least three separate, substantial European penalty tracks — an antitrust fine already confirmed final, a Digital Markets Act enforcement action with its compliance deadline. The GDPR location-data ruling layered on top.
That accumulation is worth naming. Each fine is negotiated and litigated on its specific facts. Still, the pattern across all three cases is consistent: European regulators finding that Google’s default product behaviour didn’t meet the transparency and fairness bar the EU has set, whether the law is antitrust, platform-market rules, or core data protection.
Google’s Defence: “Historical Policies” Superseded
Google’s response leaned on timing. A spokesperson said the case “centres around historical policies that have since been updated,” pointing to changes introduced from 2019 onward — automatic data deletion settings, ad management tools, and increased transparency around data usage. That’s a genuine defence on the facts: the DPC’s investigation covers conduct bounded to May 2018 through February 2020, and Google’s current product behaviour may well differ from what regulators examined.
By contrast, that defence doesn’t erase the finding. A company demonstrating it has since improved its practices is a mitigating factor for future conduct, not a retroactive justification for what the DPC found during the period under investigation — which is why the fine stands despite Google’s changes.
TF Summary: What’s Next
Google has six months to bring its data processing into full compliance with the DPC’s findings. No confirmed appeal has been announced, though Google has appealed comparable Irish DPC fines in the past. The DPC continues operating as lead EU regulator for most major US tech companies headquartered in Ireland, with additional inquiries into other firms ongoing following the ruling.
MY FORECAST: Expect Google to comply with the six-month compliance order rather than pursue a lengthy appeal on the specific ruling, given how its public defence already concedes the practices have changed — appealing a finding about conduct the company itself calls “historical” and “since updated” offers limited strategic upside. The more interesting pattern to watch is cumulative: three simultaneous European enforcement tracks against the same company, spanning antitrust, platform regulation, and data protection, suggests EU regulators are comfortable pursuing Google on multiple legal fronts at once rather than sequencing enforcement actions one at a time.
Related Stories
- EU Fines Google €890 Million for Favouring Its Own Apps
- Google Loses Its Appeal Against a Record €4.1 Billion EU Fine
- A Reverse Lookup Service Exposed Millions of People’s Faces