Google fined more than €400m by Irish regulator over its use of location data

Google has been hit with a massive financial penalty by European regulators over its handling of personal location data, concluding a lengthy investigation into the tech giant's tracking practices. Ireland's Data Protection Commission announced a fine totaling €403 million against the company, equivalent to approximately $462 million or £345 million, following a multi-year inquiry into how user movements were logged, stored, and monetized across mobile devices.

The penalty, reported by The Guardian, stems from an inquiry originally launched six years ago. The investigation examined activities conducted between 25 May 2018 and 4 February 2020. European consumer rights organizations, including the pan-European consumer organization BEUC and the Norwegian consumer agency Forbrukerrådet, originally raised alarms that Google manipulated users into agreeing to continuous tracking on mobile phones.

Media additions

According to Siliconangle, the regulatory scrutiny zeroed in on three specific features: Web & App Activity, Timeline, and Google Location Accuracy. Web & App Activity collects information when enabled to personalize search results and local ads. Timeline logs device locations on an opt-in basis to generate maps of visited places and travel routes. Meanwhile, Google Location Accuracy utilizes built-in GPS modules alongside cellular and Wi-Fi network signals—including unique router MAC addresses—to pinpoint device whereabouts when GPS data is unavailable indoors.

Regulators concluded that Google failed to meet the lawfulness, fairness, and transparency requirements mandated by the European Union's General Data Protection Regulation. As detailed by Bleepingcomputer, the watchdog found that the company retained users' location information for longer than necessary, aggravating a loss of control over personal data.

"As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control."

Graham Doyle, Deputy Commissioner at the DPC, via The Guardian

The foundational research driving the inquiry, initially conducted by Norwegian consumer advocates, warned that continuous location tracking could inadvertently reveal intimate details about a person's life. Such data streams can expose religious beliefs through visits to places of worship, political leanings via attendance at demonstrations, health conditions through hospital visits, and sexual orientation based on patronized venues.

In response to the ruling, a Google spokesperson emphasized that the case centers around historical policies that have since been revised. The company stated that it has significantly evolved its practices and launched robust tools to simplify location data management since 2019. Furthermore, Google noted that Map Timeline information is now stored directly on user devices and automatically deletes data older than three months, while Web & App Activity saves estimated general areas rather than precise device locations.

This penalty represents the fourth-largest fine issued by the Irish watchdog since the GDPR came into force. The DPC serves as the lead supervisory authority for major United States technology companies with European headquarters located in Ireland. Consumer advocates have previously criticized the regulator for perceived delays and leniency, though digital policy directors have welcomed the enforcement action as an important milestone in online rights protection.

Alongside the financial penalty, the Irish regulator ordered Google to bring its data processing operations into full compliance with European regulations within six months. The ongoing scrutiny highlights a broader friction point across technology sectors, where regulators increasingly challenge the programmatic advertising models reliant on continuous consumer surveillance.