Cybersecurity Policy Report, Google Faces $462M Fine Over EU Privacy Violations, (Sep 21, 2026)
By Tony Foley
The Irish Data Protection Commission (DPC) has reached a final decision following its inquiry into Google Ireland Ltd. regarding the company’s processing of location data in connection with certain products and services, fining the company 403 million euros ($462 million) and ordering it to bring its processing into compliance within six months.
Background. The DPC launched an own-volition inquiry in February 2020 after receiving complaints from several European Union consumer advocates, including the European Consumer Organization (BEUC), regarding the processing of location data in Google’s Web & App Activity, Location History, and Location Accuracy features between May 2018, when the EU’s General Data Protection Regulation (GDPR) took effect, and the date it began its investigation.
DPC decision. The DPC oversees Google’s compliance with EU law because Google’s European business is based in Ireland. In a news release today, the DPC said Google violated the GDPR in regard to the following:
The lawfulness and fairness of its processing in its Web & App Activity and Location History features;
Its accountability obligations related to demonstrating the lawfulness, fairness, and transparency principle related to its processing of personal data via the Location Accuracy feature;
Its transparency obligations regarding all three cited features, and
Its retention of location data in the Web & App Activity and Location History features.
DPC Deputy Commissioner Graham Doyle noted that, while location data could greatly enhance the utility of online services, it could also reveal a significant amount of information about an individual, including inherently private information.
“The GDPR provides a high level of protection of personal data throughout the EEA [European Economic Area] and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner,” he said. “As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control.”
The DPC said the full text of the decision would be published in due course.
BEUC reaction. Agustín Reyna, BEUC’s director general, welcomed the DPC’s ruling but expressed concern over the extended duration of the agency’s investigation. “The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data,” he said in a press release. “However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement. Late enforcement can be as harmful as no enforcement at all. Consumers’ fundamental rights need to be upheld faster and better.
“Google has tracked hundreds of millions of European consumers for years to find out as much as it can about them,” he added. “Location data can be incredibly sensitive because it reveals a lot about our personal lives: where our children go to school, how many times someone visited a hospital, or even a place of prayer. This is incredibly invasive, violates fundamental rights to privacy and breaches the GDPR."
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR