Google fined €403 million over location data privacy violations in the EU

Google has been hit with a €403 million ($463 million) fine in Europe after Ireland’s privacy regulator found that the tech giant violated EU data protection rules in how it collected, used, and retained people’s location data.

Ireland’s Data Protection Commission (DPC), the lead EU privacy regulator for many large U.S. technology companies, announced the penalty Monday after a years-long investigation into Google’s location data practices. The case centered on three Google features: Web & App Activity, Location History and Location Accuracy. The regulator found violations of the European Union’s General Data Protection Regulation, or GDPR, tied to practices between 2018 and 2020.

“The Data Protection Commission (DPC) has today announced its final decision following an Inquiry into Google Ireland Limited (“Google”). This own-volition Inquiry was launched by the DPC, in its role as the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from several European consumer rights organisations, including BEUC, regarding Google’s processing of location data in connection with certain services and products,” DPC said in a news release.

The fine ranks as the fourth-largest imposed by the Irish regulator, which has levied more than €4 billion in penalties since GDPR took effect in 2018. The DPC has played an outsized role in enforcing Europe’s privacy law against Silicon Valley companies, many of which base their European operations in Ireland.

But the penalty size is only part of the story. At the heart of the case is a question that has followed Google and other advertising-driven internet companies for years: how much do users really know about the personal information being collected as they move through everyday life?

Google faces scrutiny over how it handled location data

The DPC found problems involving the lawfulness and fairness of Google’s processing of location information through Web & App Activity, an account setting covering activity across Google services, and Location History, which records where users have been through their mobile devices.

The regulator said Google’s failures meant people may not have realized their location information could be used to shape advertising or infer their interests.

“As a result of Google’s failures, individuals ‌could ⁠have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data,” DPC Deputy Commissioner Graham Doyle said in a statement.

“The retention of users’ location data for longer than necessary aggravated ⁠this loss of control.”

The DPC ordered Google to bring the affected data-processing practices into compliance within six months. Google did not immediately respond to a Reuters request for comment following the regulator’s announcement.

The case stretches back more than six years. Ireland’s regulator opened the inquiry in February 2020 after receiving complaints from consumer organizations across Europe questioning the legality and transparency of Google’s handling of location information, Reuters reported. The DPC said at the time that its investigation would examine whether Google had a valid legal basis for processing the data and whether it met its transparency obligations under GDPR.

The decision adds another major regulatory problem for Google at a time when governments are putting greater pressure on large technology companies over privacy, advertising and competition.

And the Irish regulator is not finished with Google. The DPC said three other statutory inquiries involving the company remain underway and are at advanced stages.

For Google, the €403 million penalty is substantial. For European regulators, the broader message may carry more weight: location data generated quietly in the background of everyday digital activity remains personal data, and companies processing it are expected to tell users clearly what is happening and have a lawful basis for doing so.