Google Fined €403M by Ireland’s DPC Over GDPR Violations in Location Data Handling

Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) for violating the EU General Data Protection Regulation (GDPR) in the way it processed users’ location data between May 2018 and February 2020. The penalty covers three Google features: Web & App Activity, Location History, and Location Accuracy.

Impact

The DPC found that Google failed to provide lawful, fair, and transparent processing of location data, and that it retained such data longer than necessary. Users could have been unaware that their movements were tracked and used for advertising or profiling, and they lost control over their personal information.

What Defenders Should Do

Review any systems that collect, store, or analyze location data. Confirm that a lawful basis exists, that users are clearly informed, and that retention periods are limited to what is strictly required for the stated purpose.

Key Compliance Actions

• Document the lawful basis for each location‑data processing activity.
• Implement clear opt‑in/opt‑out mechanisms and provide concise privacy notices.
• Set automated deletion or anonymisation schedules that align with the minimal‑retention principle.
• Conduct regular audits to verify that location data is not processed beyond the agreed scope.

“These failures meant people could have been unaware that their location was being used, for example, to influence them with ads or to infer their interests,” said DPC Deputy Commissioner Graham Doyle.