Irish Regulator Fines Google €403 Million Over Location Data
Ireland’s Data Protection Commission fined Google Ireland Limited €403 million for GDPR violations involving the processing of location data.
Google’s fine over location data stems from a final decision by Ireland’s Data Protection Commission (DPC). The regulator imposed administrative fines totaling €403 million on Google Ireland Limited for processing users’ location data.
The investigation covered the period from May 25, 2018, to February 4, 2020, and the Google features “Web & App Activity,” “Location History,” and “Location Accuracy.” The DPC found violations of the EU General Data Protection Regulation, known as the GDPR.
Google’s Fine and the DPC’s Findings
According to the DPC’s notice, the violations concerned the lawfulness, fairness, and transparency of personal data processing. The regulator also cited shortcomings in demonstrating compliance with GDPR rules and in retaining data longer than necessary.
The DPC ordered Google to bring the processing in question into compliance within six months. This is therefore not just a financial penalty: the company must adjust procedures related to the affected location data within the specified deadline.
The Irish regulator’s full decision has not yet been published. As a result, the public does not have all the details of the legal reasoning or the precise scope of the specific remedial steps.
Why Location Data Is Sensitive
Location data can reveal a user’s movements, places visited, or interests. The case therefore highlights the importance of clearly explaining how this data is used and how long it is retained in product and account settings.
The decision applies to a historical period. According to a statement cited by public broadcaster RTÉ, Google said the case concerns rules that the company later changed. Without the full decision being published, however, it is not yet possible to independently assess the scope of those changes in relation to all of the DPC’s findings.
What Happens Next
The €403 million fine is among the largest penalties the Irish regulator has imposed on a major technology company. It has not yet been confirmed whether Google will seek a remedy or challenge the decision in court.
Further important steps will include publication of the DPC’s full decision, any action by Google against the verdict, and the specific measures the company will take to demonstrate compliance with the six-month remediation deadline.
Sources
- Data Protection Commission – Primarily confirms the amount of the fine, the scope of the investigation, the GDPR violations identified, and the six-month remediation deadline.
- RTÉ – Corroborates the regulator’s announcement and reports Google’s response that the case concerns historical practices.
- AP – Independently confirms the fine and the case’s connection to EU data protection rules.
Verified and updated: September 21, 2026 15:22
