What happened

Ireland's Data Protection Commission (DPC) has fined Google €403 million, about $463 million, for breaking the GDPR in the way it handled Europeans' location data. The decision was announced on Monday, 21 September, and it comes with a second part that matters as much as the money: Google has six months to bring its processing into compliance.

The fined entity is Google Ireland Limited. Because Google's EU headquarters sits in Dublin, the DPC acted as lead supervisory authority for the whole bloc, and the European Data Protection Board published the final decision. Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney signed it.

Google's Dublin headquarters, which makes Ireland's DPC its lead EU regulator. Photo: Jmckinley, Wikimedia Commons, CC BY-SA 3.0.

The conduct is old. The inquiry opened in February 2020 and examined the period from 25 May 2018, the day the GDPR took effect, to 4 February 2020. Nothing in the decision says Google is breaking these rules today.

Even so, it is the DPC's fourth-largest GDPR fine. Only Meta (€1.2 billion, 2023), TikTok (€530 million) and Instagram (€405 million) paid more. Google missed third place by €2 million.

Three settings, four findings

The inquiry looked at three features. Web & App Activity records what you do across Google services, location included. Location History was the opt-in service that tracked a phone and inferred the places and routes behind Google Maps Timeline. Location Accuracy is the Android feature that sharpens a position beyond what GPS can manage alone.

The DPC found four separate infringements:

• Lawfulness and fairness - the processing of location data in Web & App Activity and Location History had neither.
• Accountability - for Location Accuracy, Google could not demonstrate that it met the lawfulness, fairness and transparency principle.
• Transparency - all three features fell short of what users had to be told.
• Retention - location data in Web & App Activity and Location History was kept in breach of the rules.

The EDPB cites GDPR Articles 5, 6, 12 and 13: the core principles, the legal basis for processing, and the two articles on what a company must tell people and how clearly. The DPC did not say how the €403 million divides across the findings.

Deputy Commissioner Graham Doyle framed the case around what location reveals. "Location data can bring both benefits and harms to individuals," he said. "It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private." According to the Irish Times, he added that users could have been unaware their location was being used to "influence them with ads or to infer their interests, and could lose control over their personal data".

Almost eight years from complaint to fine

The case began in November 2018, when eight consumer groups in Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland, Sweden and Denmark filed complaints coordinated by BEUC, the European consumer organisation. Their evidence came from the Norwegian Consumer Council's research into how Google's screens steered people into sharing location. In 2022 the groups complained again, because the deceptive design they had flagged was still there.

BEUC welcomed the fine and criticised the wait in the same breath. "The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples' location data," said Director General Agustín Reyna. "Google has tracked hundreds of millions of European consumers for years to find out as much as it can about them."

Then the sharper line: "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement. Late enforcement can be as harmful as no enforcement at all."

That is hard to argue with on the dates alone. A complaint filed in 2018 has produced a penalty in 2026 for conduct that ended in early 2020. BEUC calls geolocation "one of the most invasive forms of commercial surveillance" because it can reveal religion, health, politics and sexual orientation, and for most of those eight years the data in question kept sitting in Google's systems.

What Google says has changed

Google's response, from an unnamed spokesperson, leans on the age of the case: "This case centers around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."

The biggest of those changes came on 12 December 2023, when Google Maps announced that Timeline would move off Google's servers and onto the phone. The default auto-delete period dropped from 18 months to 3. Cloud backup became optional and end-to-end encrypted, so Google itself cannot read it. Tapping the blue location dot in Maps now opens the location controls directly.

Google also says Web & App Activity no longer saves a device's precise location, and points to auto-delete options running from 3 to 36 months.

Those changes are real, and they address two of the four findings head-on: retention and, arguably, transparency. They do not settle the case. The six-month compliance order applies to how Google processes data now, which means the regulator will measure today's settings against its findings rather than take the 2023 announcement as the last word.

What to check in your own account

The ruling asks nothing of users, and it does not come with a refund. It is still a good reason to spend five minutes on three controls, all of which exist as of September 2026.

Start with Web & App Activity in your Google account. See whether it is on, and if it is, pick an auto-delete period; the shortest Google offers is three months.

Timeline is now stored on your phone. If you turned on the encrypted backup, your history also lives in Google's cloud, which is convenient when you change phones and pointless if you never look at your Timeline. The quickest way in is the blue dot in Google Maps.

Location Accuracy sits in your Android phone's location settings, not in your Google account. It is the one the DPC said Google could not show was lawful, fair and transparent, so it deserves a look even if you have never touched it.

For developers building anything that collects location, the findings read as a checklist of what fails: consent obtained through screens designed to nudge, a retention period nobody defined, and a feature whose data use the company cannot document. Any one of those was enough for a finding here.

What comes next

Google now has six months to comply. It has not said it will appeal, although the Irish Times reports it is understood Google may challenge elements of the decision, which would move the fight to the Irish courts.

This is also not the DPC's last word on Google. The regulator has three other large-scale inquiries into the company at advanced stages, so more decisions are likely to follow, possibly on a shorter clock than this one's eight years.