IRELAND’S Data Protection Commission (DPC) has fined Google €403 million (approximately US$463 million) over its processing of users’ location data and ordered the company to change its practices within six months. The decision follows a six-year investigation, launched in 2020 after complaints linked to a 2018 Norwegian Consumer Council report. The DPC examined activity between May 2018 and February 2020, focusing on Google’s Web & App Activity, Location History and Android’s Location Accuracy features.
The regulator found that Google had not processed location data lawfully, fairly or transparently in relation to Web & App Activity and Location History, and had retained some information longer than necessary. It also concluded that Google failed to demonstrate compliance with transparency and accountability requirements for Location Accuracy. According to the DPC, these shortcomings could leave users unaware that their data was being used for targeted advertising or to infer personal interests. The authority described the fine as the fourth-largest GDPR penalty it has issued.
Google said the case concerned older privacy policies and that it had substantially changed its practices since 2019. It pointed to auto-deletion controls allowing users to remove location data on rolling three-, 18- or 36-month schedules. The ruling nevertheless makes clear that later changes do not remove liability for earlier GDPR violations.