Google fined €403m by EU over location data

Google has been fined 403 million euros by Ireland's data protection watchdog, acting on behalf of the European Union, for improperly using users' location data.

Ireland's Data Protection Commission said Monday that Google infringed the EU's General Data Protection Regulation between May 2018 and February 2020. The regulator said the fine was its fourth largest.

The DPC said its final decision found breaches involving the lawfulness and fairness of Google's processing of location data in web and app activity and location history. It also ordered Google to bring its processing into compliance within six months.

DPC deputy commissioner Graham Doyle said Google's failures meant individuals could have been unaware that their location was being used, including to influence them with ads or infer their interests. He said retaining users' location data for longer than necessary aggravated the loss of control.

Google said the case centred on historical policies that have since been updated. The company said it had significantly evolved its practices from 2019 onward and launched tools to make managing location data simple.

The case followed coordinated complaints filed in November 2018 by European consumer organisations in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia and Sweden.

European consumer organisation BEUC, which brought together the groups, called the ruling an important decision. BEUC director general Agustin Reyna said it held Google accountable, but said the time taken to reach the decision was disproportionate to the seriousness of the infringement.

The DPC said Google is also the subject of three other investigations that are at an advanced stage, including proceedings opened in September 2024 on whether the company failed to conduct an impact assessment over the use of Europeans' personal data to train Google's artificial intelligence.

The largest DPC fine was imposed on Facebook owner Meta in 2023: 1.2 billion euros for transferring data to the United States.