Ireland's data protection regulator fines Google €403 million over location data

Ireland's regulator fines Google €403 million

The Data Protection Commission (DPC) has published its final decision in an inquiry into Google Ireland Limited, imposing administrative fines totalling €403 million. The decision was taken by the Commissioners for Data Protection — Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney — and announced on 21 September 2026.

What the inquiry covered

The DPC opened the inquiry on its own initiative in February 2020, in its role as lead supervisory authority for Google, after complaints from several European consumer rights organisations, including BEUC, about the company's processing of location data. The investigation covered three features — "Web & App Activity", "Location History" and "Location Accuracy" — between 25 May 2018, the date the GDPR became applicable, and 4 February 2020.

Where the regulator found breaches

The DPC found that Google infringed the GDPR on four points: the lawfulness and fairness of its processing of location data in Web & App Activity and Location History; its accountability obligations, because it could not demonstrate compliance with the lawfulness, fairness and transparency principle for Location Accuracy; its transparency obligations for all three features; and its retention of location data in Web & App Activity and Location History. Google has also been ordered to bring its processing into compliance within six months.

Why location data matters

Deputy Commissioner Graham Doyle said location data is personal data processed through location tracking, and includes data collected or processed by Google from which an individual's location can be inferred, alone or together with other information. Such data, he said, can bring both benefits and harms: it can greatly enhance the utility of online services, but can also reveal a significant amount of information about a person, including information that is inherently private. "As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," he said, adding that retaining location data longer than necessary aggravated that loss of control. The DPC said it is grateful for the cooperation and assistance of its peer supervisory authorities in the case.