Google Fined Record-Breaking €403 Million Over Location Data Privacy

Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463 million), closing out a six-year investigation into how the company tracked and stored location data of its users across three separate Android and web features. The penalty, confirmed by The Irish Times, Euronews, and Security Affairs, marks one of the largest single GDPR sanctions ever handed to Google.

The DPC's decision covers Web & App Activity, Location History, and Location Accuracy, which collected and processed location signals without meeting the GDPR's lawfulness, fairness, and transparency standards. Regulators concluded that Google did not process location data lawfully or fairly through Web & App Activity and Location History, and separately found the company failed to demonstrate compliance with the lawfulness, fairness, and transparency principle for Location Accuracy on Android.

The DPC opened its inquiry in February 2020 after complaints from European consumer rights groups. Investigators examined a specific window of conduct: from May 25, 2018, when the GDPR took effect, through February 4, 2020, when the formal inquiry began. Alongside the €403 million fine, the DPC ordered Google to bring its location-data processing into compliance within six months.