Ireland's Data Protection Commission Fines Google €403m Over Location Data Processing

Ireland's Data Protection Commission (DPC) has fined Google €403 million following an inquiry into how the company processed users' location data, and has ordered Google to bring its processing into compliance within six months, according to RTÉ News. Reuters, in a report carried by Duke FM, put the figure at €403 million ($463 million), using a conversion rate of $1 = 0.8712 euros, and described the DPC as the lead EU privacy regulator for most major US internet firms because their European operations are headquartered in Ireland.

What the investigation examined

The inquiry was opened in 2020 after the DPC received complaints from several European consumer rights organisations about Google's processing of location data in connection with certain services and products, as reported by both RTÉ and Reuters; RTÉ dated the launch to February 2020. The investigation focused on the period from May 2018 to February 2020 and examined location settings on services including Google's search engine and Google Maps, as well as location accuracy features on Android devices, according to RTÉ.

The decision was issued by the Commissioners for Data Protection, Dr Des Hogan, Dale Sunderland and Niamh Sweeney, who found that Google had infringed the General Data Protection Regulation (GDPR), RTÉ reported. Under data protection rules, location information must be processed in a lawful, fair and transparent manner, and the DPC said its investigation found failures in this respect.

Regulator's rationale

DPC Deputy Commissioner Graham Doyle said the failures identified meant individuals could have been unaware that their location was being used to, for example, influence them with ads or infer their interests, and could lose control over their personal data, according to statements carried by both RTÉ and Reuters. Doyle added: "The retention of users' location data for longer than necessary aggravated this loss of control."

Doyle also set out how the DPC defines the data at issue: location data is a type of personal data processed by way of location tracking, and includes data collected or processed by Google from which, alone or together with other information, an individual's location can be inferred. The DPC separately noted that location data can enhance the utility of online services but can also reveal a significant amount of information about an individual, including data that is inherently private.

Compliance order and its scope

Alongside the fine, the DPC has ordered Google to bring its location-data processing into compliance within six months, per RTÉ's report. Neither RTÉ nor Reuters reported a breakdown of the fine across individual infringements, nor the specific technical or policy changes the six-month order requires. Interpreting the regulator's stated rationale: because Doyle's reported concern was that users could have been unaware their location was being used to influence them with ads or infer their interests, ad personalisation and interest profiling appear central to the DPC's findings — though the regulator's reported statements do not specify any ban or mandated change to ad-serving mechanics.

Google's response

Google said the case centres on historical policies that have since been updated. "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple," a spokesperson said, according to RTÉ. The company pointed to changes including settings to automatically delete data, ad management tools and increased transparency around how data is used, RTÉ reported.

On a possible appeal, the reporting is mixed. RTÉ reported that it is understood Google will appeal the ruling, focused on legal issues it says require clarification beyond this case. Reuters said Google did not immediately respond to its request for comment. The appeal outlook should therefore be read as an expectation reported by RTÉ rather than a confirmed company statement.

How the fine compares

Reuters characterised the €403 million penalty as the fourth largest fine levied by the Irish regulator, which it described as the lead EU privacy regulator for most of the top US internet firms because their EU operations are based in Ireland. The prior fines that would be needed to verify that ranking were not detailed in the reporting reviewed.

Bottom Line

The DPC's decision, made by Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney, found Google infringed the GDPR over the May 2018 to February 2020 period, with the regulator saying users could have been unaware their location data was feeding ad influence and interest inference, aggravated by retention for longer than necessary. Google frames the underlying policies as historical and superseded by changes from 2019 onwards. With a six-month compliance deadline and an appeal reported as likely but not confirmed by the company, the practical effect on Google's EU location-data and ad-personalisation practices is not yet established by the reporting to date.