EU fines Google €403m over location data privacy violations

September 21, 2026 at 03:40 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The Irish Data Protection Commission fined Google €403 million for GDPR violations in processing user location data from May 2018 to February 2020. The regulator found Google failed to lawfully process location data, demonstrate compliance, and meet transparency obligations across Web & App Activity, Location History, and Location Accuracy features. Google has six months to bring its services into compliance.

Key Facts

The Irish Data Protection Commission fined Google €403 million ($460 million) for GDPR violations related to location data processing.
The investigation covered Google's Web & App Activity, Location History, and Location Accuracy features between May 2018 and February 2020.
Google has six months to bring its services into compliance with EU GDPR regulations.
The probe began in February 2020 following complaints from European consumer rights organisations, including BEUC.
DPC Deputy Commissioner Graham Doyle said users may have been unaware their location data was used for ad targeting or interest inference.

The Investigation

The Irish Data Protection Commission launched its inquiry in February 2020 after receiving complaints from European consumer rights organisations, including BEUC. The investigation examined Google's processing of location data across its Web & App Activity, Location History, and Location Accuracy features from May 2018 to February 2020. The DPC found that Google infringed the GDPR by failing to lawfully process location data, failing to demonstrate compliance, and failing to meet transparency obligations. The probe concluded after six years, resulting in a €403 million fine and an order to become compliant within six months.

Regulator Findings

DPC Deputy Commissioner Graham Doyle stated that users could have been unaware their location data was used to influence them with ads or infer their interests. Doyle added that retaining users' location data for longer than necessary aggravated the loss of control over personal data. The DPC noted that location data reveals deeply personal aspects of an individual's life, and the violations led to users losing control over their personal information. The fine is the third largest imposed by the Irish DPC, which serves as the lead EU regulator for major American technology companies including Google.

Compliance Deadline

Google has six months to bring its services into full compliance with the EU's General Data Protection Regulation. The DPC's order requires Google to address the identified failures across the Web & App Activity, Location History, and Location Accuracy features. The penalty adds to a series of sanctions against Big Tech companies, signalling increased regulatory scrutiny by European authorities.