Ahmed Shaami
Ireland’s Data Protection Commission has fined Google €403 million after a six-year investigation into how the company handled location data collected through Android devices and Google account settings. The DPC ruled that Google broke the GDPR’s transparency and data retention rules in three specific features between 25 May 2018 and 4 February 2020, and has given the company six months to bring its processing into compliance. The penalty is the fourth-largest the Irish regulator has issued since GDPR took effect.
Three Features, One Common Failure
The inquiry, opened by the DPC in February 2020 after complaints from European consumer groups including BEUC, examined three Google features: Web & App Activity, Location History, and Location Accuracy. Web & App Activity is a Google account setting that can capture browsing history, search history, and location data. Location History tracks a user’s movements through compatible devices and displays them on a private Google Maps timeline. Location Accuracy is an Android feature that sharpens a device’s location beyond what GPS alone provides, and it applies to any Android user, not just those signed into a Google account.
The Commissioners for Data Protection, Des Hogan, Dale Sunderland and Niamh Sweeney, found that Google failed to process location data lawfully and fairly in Web & App Activity and Location History, could not demonstrate accountability for its handling of Location Accuracy, fell short on transparency obligations across all three features, and retained location data for longer than necessary in two of them.
Deputy Commissioner Graham Doyle said the retention failures compounded the harm. “The retention of users’ location data for longer than necessary aggravated this loss of control,” he said, adding that location data can reveal information “that is inherently private” even when it sits behind a feature that looks like a simple convenience setting.
A Familiar Name on Ireland’s Fine List
The DPC has now issued four penalties above €400 million against major platforms since GDPR came into force: Meta at €1.2 billion, TikTok at €530 million, Instagram at €405 million, and now Google at €403 million. Ireland regulates Google, Meta and TikTok’s EU operations because each company’s European headquarters sits in Dublin, which has made the Data Protection Commission the most consequential privacy enforcer on the continent, even as critics have periodically accused it of moving too slowly. This case took six years from complaint to decision.
Google has not said whether it will appeal. The DPC noted it will publish the full decision in due course, and the European Data Protection Board has already flagged the case to its members, which means the legal reasoning behind it is likely to shape how other EU regulators treat location-data complaints going forward.
The Part That Matters If You Run Ads for Clients
Freelancers and agencies who manage Google Ads or Google Analytics accounts, especially for clients with EU customers, are the ones most likely to feel this ruling before ordinary users notice anything. Location-based targeting is a standard lever in Google Ads campaigns, and the features named in this decision, Web & App Activity and Location Accuracy in particular, feed the audience data those campaigns draw on. If Google tightens consent prompts or shortens retention windows to meet its six-month deadline, ad managers should expect changes to how location audiences are built and how long that targeting data stays usable.
For small businesses in Pakistan and the Gulf serving European customers, or freelance marketers billing EU-based clients, the practical takeaway is narrower than the headline number suggests: check whether active campaigns lean on Google’s location signals, and be ready to explain to a client why a location-based audience segment shrinks if Google changes how it collects that data.
Google now has until roughly March 2027 to show the DPC it has fixed its practices. Whether that shows up as a quiet backend change or a visible shift in what location settings ask users to agree to should become clear well before that deadline arrives.
