Google fined €403 million in Ireland over location data
Ireland's Data Protection Commission has fined Google €403 million under the GDPR over location data in Web & App Activity, Location History and Location Accuracy, and given it six months to comply.
Ireland's Data Protection Commission (DPC) has fined Google €403 million under the GDPR over how it handled people's location data. The regulator announced its final decision on 21 September 2026, more than six years after it opened the inquiry in February 2020.
The fine covers three Google settings - Web & App Activity, Location History and Location Accuracy - and conduct between 25 May 2018 and 4 February 2020. Alongside the money, Google Ireland Limited has been ordered to bring its processing into compliance within six months.
What the DPC decided
The DPC acts as Google's Lead Supervisory Authority in the EU, because Google's European operations are run from Ireland. It opened this own-volition inquiry in February 2020 after complaints from several European consumer rights organisations, including BEUC, the European Consumer Organisation.
The final decision imposes administrative fines totalling €403 million, roughly $460 million at current exchange rates, and an order requiring Google to bring its processing into compliance within six months. It was made by the three Commissioners for Data Protection: Dr Des Hogan, Dale Sunderland and Niamh Sweeney. The European Data Protection Board has also published the announcement, confirming the €403,000,000 figure and the compliance order.
Scope of the case
The inquiry covers location data processing from 25 May 2018, the day the GDPR started to apply, to 4 February 2020. It is a finding about that period, not a ruling on how Google handles location data today.
The three settings at the centre of the case
Web & App Activity
A Google Account setting, so it only applies to people who have an account. When it is on, Google uses it to process information about your activity on Google services, including sites and apps. According to the DPC, that can include browsing history, search history and location data.
Location History
An opt-in service that tracks your location while you carry a compatible mobile device and works out the places you visited, what you were doing and the routes between them. It powers Timeline, the private map in Google Maps, and saves where you go with signed-in devices even when you are not using a Google service.
Location Accuracy
An Android operating system feature that helps a phone work out its location more precisely than GPS alone. Unlike the other two, it is available to Android users whether or not they have a Google Account.
What the regulator found
The DPC found four groups of infringements, and they do not apply equally to all three settings:
- Lawfulness and fairness: the processing of location data in Web & App Activity and Location History was not lawful and fair.
- Accountability: for Location Accuracy, Google could not demonstrate that it complied with the principle of lawfulness, fairness and transparency.
- Transparency: Google fell short of its transparency obligations for all three features.
- Retention: location data in Web & App Activity and Location History was kept for longer than necessary.
Location Accuracy therefore comes out of the decision with narrower findings: accountability and transparency, but no finding of unlawful processing or excessive retention. The DPC has not yet published the full decision, so there is no breakdown of how much of the €403 million relates to each feature.
Deputy Commissioner Graham Doyle explained why the regulator treats location data so seriously:
Graham Doyle, Deputy Commissioner, DPC
"Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual's location can be inferred. Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private. The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner. As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users' location data for longer than necessary aggravated this loss of control"
Where the fine ranks
At €403 million this is the DPC's fourth-largest GDPR fine. Only three penalties are bigger:
- Meta: €1.2 billion (2023)
- TikTok: €530 million
- Instagram: €405 million
- Google: €403 million (2026)
The gap to Instagram's penalty is just €2 million.
How Google responded
Google's position is that the case is about the past. The company says it centres on "historical policies that have since been updated", and in a statement said: "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."
The main change Google points to is how Timeline works today. In a blog post on 12 December 2023, Marlo McGriff, Director of Product for Google Maps, announced that Timeline would be saved on the user's device rather than in the account, that optional cloud backups would be automatically encrypted so that "no one can read it, including Google", and that the default auto-delete period for Location History would drop from 18 months to 3 months. Google said the rollout would happen gradually over the following year on Android and iOS.
None of that changes the outcome of this case. The decision looks at what Google did between May 2018 and February 2020, when Location History data lived in the Google Account and the defaults were different.
What happens next
- Compliance deadline: Google has six months to bring its processing into line with the GDPR.
- Full decision: the DPC says it will publish the full text "in due course". That should show how the fine was calculated and which GDPR articles were breached.
- Possible appeal: the Irish Times reports it is understood Google may appeal elements of the decision. According to The Hacker News, Google can appeal to the Irish High Court within 28 days of receiving formal notice.
How to check your own location settings
The case covers old practices, but the settings still exist. Malwarebytes suggests these steps if you want to limit what Google keeps:
- Turn off Timeline in Google Maps. On its own this does not stop all location saving.
- Open your Google Account's Data & privacy settings, check Web & App Activity and turn it off if you do not want activity, including location, saved to your account.
- Check Search Services History where it is shown, since search activity can also carry location.
- Delete the activity and location data already stored in your account.
Tip
Turning a setting off stops new data from being saved. It does not remove what is already there, so delete past activity as a separate step.
Sources
- Data Protection Commission announcement: https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location
- European Data Protection Board: https://www.edpb.europa.eu/news/the-irish-data-protection-commission-fines-google-403-000-000-eur-following-inquiry_en
- The Irish Times: https://www.irishtimes.com/business/2026/09/21/irish-data-protection-watchdog-fines-google-403m-over-gdpr-breaches/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/google-fined-403-million-over-location-data-privacy-violations/
- The Hacker News: https://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.html
- Malwarebytes: https://www.malwarebytes.com/blog/news/2026/09/googles-location-data-privacy-failures-draw-a-e403-million-fine
- Google Keyword blog, December 2023: https://blog.google/products/maps/updates-to-location-history-and-new-controls-coming-soon-to-maps/
Key takeaways
- Ireland's DPC fined Google €403 million on 21 September 2026 over location data processing in Web & App Activity, Location History and Location Accuracy.
- The case covers 25 May 2018 to 4 February 2020, and Google has six months to bring its processing into compliance.
- Unlawful processing and over-retention findings apply to Web & App Activity and Location History; Location Accuracy was faulted on accountability and transparency.
- It is the DPC's fourth-largest fine, €2 million behind Instagram's €405 million.
- Google says the case is about historical policies and points to on-device Timeline and a 3-month auto-delete default. It may appeal.
More in Tech News
Browse Tech News