Google has been fined €403 million ($463 million) by Ireland’s Data Protection Commission over violations of European Union privacy rules linked to its handling of users’ location data.
The Irish regulator said an investigation found that Google did not lawfully and fairly process location information collected through its Web & App Activity and Location History features.
The investigation also found shortcomings in the way Google processed personal data through Location Accuracy, a feature of the Android operating system.
The case was handled by Ireland because Google’s European headquarters is based in Dublin, making the country the company’s lead data protection regulator within the European Union.
The investigation examined Google’s practices from May 25, 2018, when the General Data Protection Regulation, GDPR, took effect, through February 4, 2020. The inquiry followed complaints from European consumer rights organisations.
According to the Data Protection Commission, Google infringed GDPR requirements covering the lawfulness and fairness of processing location data through Web & App Activity and Location History. The regulator also found failures relating to transparency, accountability and the retention of location data.
The regulator ordered Google to bring its processing practices into compliance within six months in addition to the €403 million administrative fine.
Deputy Commissioner Graham Doyle said location information can improve the usefulness of digital services but can also expose highly private information about individuals.
Google said the case concerned historical policies that had since been changed.
The company said it had significantly updated its practices from 2019 and introduced tools intended to give users greater control over how their location information is managed.
The fine is among the largest issued by Ireland’s data protection regulator. The watchdog has previously imposed larger penalties on companies including Meta and TikTok.
The regulator said it still has three other ongoing investigations involving Google, underscoring the continuing scrutiny of the company’s data practices in Europe.
The latest case also highlights the sensitivity of location data under Europe’s privacy framework. Information about where a person lives, works or travels can reveal patterns of behaviour and other details that may not be immediately apparent from individual pieces of data.
