Ireland’s €403 million fine against Google is best read as a further test of the European Union’s ability to police the data practices of large technology companies whose regional operations are based in Dublin. The Data Protection Commission (DPC), Google’s lead EU regulator, issued the penalty on 21 September 2026 after finding that the company had processed location data in ways that were not ‘lawful’, ‘fair’ or ‘transparent’.
The inquiry concerned Google’s Web & App Activity, Location History and Location Accuracy features between 25 May 2018 to 4 February 2020. The DPC said Google had breached General Data Protection Regulation (GDPR) rules governing the lawfulness and fairness of location-data processing in Web & App Activity and Location History.
The regulator also found that Google failed to meet its accountability duties in relation to Location Accuracy because it did not demonstrate compliance with the GDPR. It found transparency breaches across all three features. Google also kept location data collected through Web & App Activity and Location History for longer than necessary, the DPC said.
The penalty is one of the largest imposed by the Irish authority and ranks fourth among all DPC fines. The regulator has ordered Google to bring its processing into compliance within 6 months.
The case began with coordinated complaints from consumer organisations in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia and Sweden. The complaints were first made in November 2018, and the DPC opened its inquiry in February 2020.
Graham Doyle, the DPC’s Deputy Commissioner, said people could have been unaware that their location information was used to influence them through advertising or to draw conclusions about their interests. That could leave them with less control over their personal data, he said.
“Location data can reveal a significant amount of information about an individual, including information that is inherently private,” Doyle said. He added that retaining users’ location data longer than necessary compounded the loss of control over that information.
The European Consumer Organisation criticised the eight-year period between the initial complaints and the ruling. The DPC did not set out in the information released with the decision why the process took that length of time.
Google said the case concerned historical policies that it had since changed. The company said it had significantly developed its approach from 2019 onwards and introduced robust tools to help people manage location data. It did not state whether it would appeal the decision.
Ireland holds a central position in EU privacy enforcement because Google’s European headquarters is in Dublin. The DPC has collected more than €4 billion in fines since becoming the lead EU regulator for major U.S. technology companies under the 2018 GDPR framework.
The authority also has three other privacy investigations involving Google under way, although the DPC has not identified them in the material surrounding this decision. The latest fine adds to scrutiny of how companies use location information, which can reveal patterns of behaviour, association and movement beyond standard metadata.
Comments (0)