Ireland fines Google 403 million euros over location-data privacy violations

Ireland’s Data Protection Commission has fined Google €403 million, or about $463 million, for multiple violations of the European Union’s General Data Protection Regulation tied to how the company processed users’ location data.

The DPC opened its investigation in February 2020 after receiving complaints from several European consumer groups, including BEUC, about Google’s handling of location data. The inquiry examined three Google features, Web & App Activity, Location History and Location Accuracy, as they operated between May 25, 2018, when the GDPR took effect, and Feb. 4, 2020.

Web & App Activity is a setting for Google Account holders that lets the company process activity across its services, potentially including browsing history, search history and location data. Location History is an opt-in service that tracks users carrying compatible mobile devices, inferring places visited, activities and routes, and displaying that information through a private Google Maps Timeline even when a person isn’t actively using a Google service. Location Accuracy is an Android feature that sharpens a device’s position beyond what GPS alone provides and is available to any Android user regardless of whether they have a Google account.

The DPC, led by commissioners Des Hogan, Dale Sunderland and Niamh Sweeney, found that Google’s processing of location data through Web & App Activity and Location History did not meet the GDPR’s requirements for lawfulness and fairness, and that the company failed to demonstrate that Location Accuracy complied with the regulation’s lawfulness, fairness and transparency rules. Investigators said Google failed to meet transparency obligations across all three features and retained location data collected through Web & App Activity and Location History longer than necessary.

Deputy Commissioner Graham Doyle said individuals could have been unaware that their location was being used to influence them with ads or infer their interests, which he said meant they could lose control over their personal data. He said Google’s retention of the data longer than necessary made that loss of control worse.

The DPC ordered Google to bring its data processing into compliance within six months. The agency has not yet published its full decision but said it plans to do so.

A Google spokesperson said the case centers on historical policies that have since been updated, and that the company has significantly evolved its practices since 2019 and launched tools that make managing location data simpler. Google said it has since added controls letting users set a schedule for automatically deleting account data, that Google Maps Timeline information is now stored on the device and automatically deleted after three months, and that Web & App Activity no longer saves a device’s precise location, only an estimated general area.

The fine is the fourth-largest EU privacy penalty issued by the Irish regulator, which has previously fined TikTok and Meta, including a record €1.3 billion penalty against Meta over the transfer of European users’ data to the United States. The investigation took roughly six years from the initial complaints to the decision.