Google Fined €403 Million by Ireland Over EU Location Data Privacy Breaches

Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) for breaching EU privacy rules in its handling of users’ location data, following an investigation covering practices between May 2018 and February 2020 in Europe.

The DPC found Google’s processing through Web & App Activity and Location History did not meet requirements for lawfulness and fairness. Web & App Activity can process browsing history, search history and location data. Location History, which users opt into, processes information about places visited, activities and routes and displays it through Google Maps’ Timeline.

Regulators also found that Google did not demonstrate compliance with GDPR requirements for lawfulness, fairness and transparency in its Location Accuracy feature on Android. The feature helps devices determine location more accurately than relying on GPS inputs alone.

The DPC said transparency obligations were breached across all three features. It also found that location data processed through Web & App Activity and Location History was retained for longer than necessary.

Ireland is the lead EU regulator for Google because the company’s European headquarters are in Dublin. The inquiry was launched in February 2020 after complaints from several European consumer rights organisations, including BEUC.

The regulator said location data can reveal information about an individual’s movements and private details. It has ordered Google to bring the relevant processing into compliance with GDPR requirements within six months.

Google said the case concerns historical policies that have since been updated. The company said it had significantly changed its practices from 2019 and introduced tools to make managing location data simpler, including controls and automatic deletion.

The €403 million penalty is the fourth-largest fine issued by Ireland’s DPC. The watchdog has previously imposed larger penalties on companies including Meta and TikTok, with one Meta fine reaching €1.2 billion.

The DPC said three other statutory investigations involving Google remain ongoing and are at an advanced stage. It has not disclosed their subjects or possible outcomes.

The September 21 decision concerns Google’s historical location-data processing under the GDPR.