Google fined €403 million over location data

What happened

On 21 September 2026, Ireland’s Data Protection Commission (DPC), acting as lead supervisory authority, announced a final decision fining Google Ireland Limited €403 million over the processing of location data through three account features: Web & App Activity, Location History and Location Accuracy. The DPC also ordered Google to bring its processing into compliance within six months.

The inquiry covered processing between 25 May 2018, when the GDPR began to apply, and 4 February 2020. It began in February 2020 and followed complaints that consumer organisations coordinated by BEUC, the European Consumer Organisation, announced on 27 November 2018. Those complaints drew on the Norwegian Consumer Council’s “Every Step You Take” research. The decision came more than six and a half years after the inquiry opened and nearly eight years after the complaints.

BEUC director general Agustín Reyna said the decision holds Google accountable, and added: “Late enforcement can be as harmful as no enforcement at all.”

Google is reported to be planning an appeal. It has said the case concerns past practices that it has changed since 2019. As of publication, we have found no report of an appeal outcome.

What the DPC found

The decision is not about Google collecting location data as such. It concerns how the collection was explained, justified and limited. According to the DPC’s announcement, Google:

infringed the GDPR’s requirements of lawfulness and fairness in its processing of location data through Web & App Activity and Location History;
breached its accountability obligations for Location Accuracy, by failing to demonstrate compliance with the lawfulness, fairness and transparency principle, which is a different finding from saying the processing itself was unlawful;
breached transparency obligations in respect of all three features; and
retained location data in Web & App Activity and Location History for longer than necessary.

The EDPB’s republication of the decision lists Articles 5, 6, 12 and 13 GDPR. The DPC has not published a breakdown of the fine by feature.

None of these findings rests on a novel legal theory. They are the four questions any consent and disclosure layer has to answer: is the lawful basis valid, is the user told clearly what happens to their data, can the controller show its records after the fact, and is data deleted when its purpose ends. Reporting on the decision said users were not aware their location data could be used to target ads or infer their interests. A settings toggle that describes its purpose in general terms has the same problem as a cookie banner that says “we use cookies to improve your experience” without naming what the data feeds.

Size and timing

€403 million is the DPC’s fourth-largest GDPR fine, behind Meta’s €1.2 billion (2023), TikTok’s €530 million and Instagram’s €405 million. The amount matters less than the interval. The processing at issue took place between 2018 and 2020, and the final decision arrived in 2026. Long enforcement timelines have long tempted controllers to leave a borderline consent flow in place. Decisions like this, which turn on design choices that could have been made correctly from the start, make that bet more costly.

What to check in your own settings

If your product has a setting like Web & App Activity, meaning one toggle that covers several kinds of processing such as analytics, personalisation and cross-product sharing, review the text beside it as well as your cookie banner. Check whether that text names the specific uses of the data or only refers to “improving your experience”. Check whether users were told again when the setting’s scope changed, or whether old consent is still being relied on. Check whether you can show, today, what a given account agreed to and when, without rebuilding it from server logs. Check whether retention is tied to the stated purpose, or whether data stays by default once collected.

Ireland’s DPC fines Google €403 million over location data, nearly eight years after the complaints

What happened

What the DPC found

Size and timing

What to check in your own settings

Sources

If this applies to your site.