# Google Fined €403 Million for GDPR Violations on Location Data Irish regulator penalizes Google for transparency and user control failures in location tracking. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-21 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/ad4b920f-504c-4753-a09c-638204325e65 ## Six-year investigation concludes Ireland's Data Protection Commission (DPC) fined Google €403 million for GDPR violations related to location data practices. The investigation, initiated in February 2020, examined Google's handling of location data from May 2018 to February 2020. The case originated from complaints by European consumer groups including BEUC, focusing on transparency, data retention, and user control issues. This marks Google's fourth major EU privacy fine, following previous penalties against TikTok and Meta. ## Three problematic features The DPC identified violations across three Google location features: Web App Activity, Location History, and Location Accuracy. Web App Activity tracks signed-in users across Google services, while Location History creates a timeline of device movements. Location Accuracy, built into Android, enhances GPS data regardless of Google account status. The regulator found all three failed GDPR requirements for lawfulness, fairness, and transparency in data processing. ## Systemic compliance failures Google's violations spanned multiple GDPR principles: unlawful processing in Web App Activity and Location History, lack of transparency across all features, and excessive data retention. The Location Accuracy feature particularly concerned regulators as it affected all Android users, including those without Google accounts. Deputy Commissioner Graham Doyle emphasized how location data can reveal private aspects of individuals' lives while enhancing service utility. ## Real-world privacy impacts The DPC found Google's practices created an information gap where users might not know their location data was used for ad targeting or interest profiling. This undermined meaningful consent as users couldn't opt out of processing they didn't understand. The extended data retention period compounded these issues. Regulators focused on concrete harms rather than abstract privacy concepts - specifically users' lost control over personal data. ## Location data's dual nature While location tracking enables valuable services like accurate maps and delivery estimates, continuous collection reveals sensitive patterns about individuals' lives. The DPC noted such data can show workplaces, social circles, beliefs, and private activities. The ruling emphasizes that no form of location tracking is neutral by default under GDPR, requiring explicit lawful bases for processing. ## Regulatory enforcement timeline The case took six years from initial complaints to final decision, illustrating GDPR enforcement complexities. Google has six months to align its practices with the ruling. This follows Meta's record €1.3 billion fine for data transfers to the US. The €403 million penalty ranks as Ireland's fourth-largest privacy fine, reflecting continued scrutiny of big tech's data practices in the EU. ## Broader industry implications The decision sets precedents for how regulators interpret GDPR requirements around location data transparency and user control. It particularly affects companies relying on behavioral data for advertising. The extended investigation period suggests future cases may also take years, requiring companies to maintain compliance documentation over long periods. The ruling reinforces the EU's strict stance on data protection enforcement. ## Future compliance challenges Google faces ongoing scrutiny as location data remains crucial to its ad business. The case highlights tensions between personalized services and GDPR compliance. Companies must now demonstrate clearer consent mechanisms and data minimization practices. The decision may prompt redesigns of location features across the tech industry, particularly for services collecting data without direct user interaction. ## Sources covering this story - https://securityaffairs.com/199494/laws-and-regulations/google-fined-e403-million-over-location-data-practices.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._