Data Protection Commission fines Google €403 million following Inquiry into Google’s processing of location information | 21/09/2026

The Data Protection Commission (DPC) has at present introduced its remaining choice following an Inquiry into Google Ireland Limited (“Google”). This own-volition Inquiry was launched by the DPC, in its function because the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from a number of European client rights organisations, together with BEUC, relating to Google’s processing of location information in reference to sure providers and merchandise.

The scope of the Inquiry involved Google’s processing of location information in three particular options – “Web & App Activity”, “Location History” and “Location Accuracy” between the date of utility of the GDPR, 25 May 2018 to 4 February 2020. 

The choice, which was made by the Commissioners for Data Protection, Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney, finds that Google infringed the GDPR in respect of:

• the lawfulness and equity of its processing of location information in Web & App Activity and Location History, 
• its accountability obligations below the GDPR by failing to have the ability to show compliance with the lawfulness, equity and transparency precept relating to its processing of private information in Location Accuracy; 
• its transparency obligations in respect of all three options referred to above; and
• its retention of location information in Web & App Activity and Location History.

The DPC has imposed administrative fines totalling €403 million and has ordered Google to convey its processing into compliance inside 6 months. 

Deputy Commissioner, Graham Doyle commented:

“Location information is a sort of private information which is processed by the use of location monitoring, and consists of information collected or processed by Google, which by itself or together with different data a person’s location might be inferred. Location information can convey each advantages and harms to people. It can vastly improve the utility of on-line providers, however it may possibly additionally reveal a major quantity of details about a person, together with data that’s inherently non-public.

The GDPR gives a excessive stage of safety of private information all through the EEA, and requires that the processing of private information have to be carried out in a lawful, honest and clear method. As a results of Google’s failures on this regard, people might have been unaware that their location was getting used to, for instance, affect them with advertisements or to deduce their pursuits, and will lose management over their private information. The retention of customers’ location information for longer than crucial aggravated this lack of management”. 

The DPC is grateful for the cooperation and help of its peer supervisory authorities on this case. 

The DPC will challenge the complete choice in the end. 

Background

Web & App Activity is a Google account setting that’s solely obtainable to Google Account holders. When enabled, Google makes use of this setting to course of data associated to customers’ exercise on Google providers, together with websites and apps. The data processed can embody private information similar to shopping historical past, search historical past, and placement information.

Location History is a Google service that retains monitor of customers’ location whereas in possession of their appropriate cellular gadgets. Users should opt-in to Location History, which then processes every person’s information to deduce location data similar to place visits, actions, and paths between place visits. Location History utilises a “Timeline” characteristic, which then shows a personal map (through Google Maps) to permit the person to see the place they’ve travelled. Location History saves the non-public map of the place the person goes with their signed-in gadgets, even when the person just isn’t utilizing a Google service. 

Location Accuracy is a characteristic of Android OS that permits an Android system to find out its location with higher accuracy than merely counting on inputs from the GPS unit within the system. It is accessible to Android customers no matter whether or not they’re Google Account holders.