A major Irish GDPR decision against Google
Ireland’s Data Protection Commission has fined Google Ireland Limited €403 million after finding that the company infringed the EU’s General Data Protection Regulation in the way it processed users’ location data across three Google features: Web & App Activity, Location History and Location Accuracy . The decision, finalised on 21 September 2026 and summarised by the European Data Protection Board on 23 September, also requires Google to bring the relevant processing into compliance within six months .
The case is significant for three reasons. First, it concerns location data, a category of personal data that can reveal daily routines, visits, work patterns, health-related movements, religious activity and social relationships without users explicitly disclosing any of those facts. Second, it targets core account and Android-adjacent settings that affect how Google services collect and use signals across products. Third, the size of the penalty places the decision among the largest GDPR fines issued by Ireland’s regulator, whose Dublin remit makes it the lead authority for many large U.S. technology companies operating in Europe .
What the regulator found
The inquiry covered Google’s processing of location data between 25 May 2018, the date the GDPR began to apply, and 4 February 2020 . It examined three features: Web & App Activity, which can store search, browsing and app activity linked to a Google account; Location History, which records places a device has been; and Location Accuracy, an Android function that improves device positioning by using signals beyond GPS , .
The DPC found that Google infringed the GDPR in several connected ways. For Web & App Activity and Location History, the regulator identified failures in lawfulness and fairness of processing . For Location Accuracy, it found an accountability failure because Google was not able to demonstrate compliance with the GDPR’s lawfulness, fairness and transparency principle . The watchdog also found transparency failures across all three features, and retention failures for location data in Web & App Activity and Location History .
That combination matters. The ruling is not merely about whether a privacy notice was too vague or whether a switch was badly labelled. It links legal basis, fairness, transparency, accountability and retention into a single enforcement narrative: users must be able to understand what is happening, organisations must have a valid basis for doing it, and companies must be able to prove that their systems operate as described .
The six-month compliance clock
The financial penalty is only one part of the decision. The DPC has also ordered Google to bring the relevant location-data processing into compliance within six months . That deadline shifts the case from a historical penalty into a live operational test: Google must satisfy the regulator that its current handling of the covered processing meets GDPR requirements, not merely argue that older practices have already changed.
Google has said the case concerns policies from the period under review and that its practices have significantly evolved since 2019 . The company has pointed to easier controls for managing location data, automatic deletion mechanisms, clearer information about how location is used and changes to how Timeline data is stored , . Malwarebytes, summarising the company’s more recent product changes, noted that Google announced in December 2023 that Timeline data would move to users’ devices and that new Location History users would have a shorter default auto-delete period .
The open question is whether those changes satisfy the Irish order in full. The DPC has not yet published the complete text of its decision, and that matters because the full document will define the precise reasoning, legal analysis and boundaries of the compliance requirement , . Until then, the public record confirms the fine, the infringements identified in summary, the three features involved and the six-month compliance order, but not every technical or legal detail of the remedy .
Why location data receives special scrutiny
Location data is unusually revealing. A single coordinate may seem harmless, but repeated data points can show where a person sleeps, works, studies, shops, worships, seeks medical care or spends time with others. That is why the DPC’s deputy commissioner described location data as capable of bringing both benefits and harms: it can improve online services, but it can also reveal inherently private information .
The Google case illustrates that risk. Reports published after the decision emphasised that the regulator was concerned not only with collection, but with whether users could understand how location signals might be used to infer interests and influence advertising , . Betanews reported that Deputy Commissioner Graham Doyle said people using the features might not have realised that their location could influence the ads they saw or the interests inferred about them, with the result that they could lose control over their personal data .
That phrase — control over personal data — is central to the GDPR. The regulation does not prohibit all uses of location data. Navigation, fraud prevention, safety tools and local search can all depend on some form of location processing. But the GDPR expects organisations to explain what they collect, why they collect it, how long they keep it, and what choices individuals actually have. The Irish decision indicates that, for the historical period examined, Google’s implementation fell short across several of those requirements .
The role of Web & App Activity
One of the most important practical points is the relationship between Location History and Web & App Activity. Many users understand Location History as the obvious place to control whether Google keeps a map-like record of places they have been. But Web & App Activity is a separate account setting that can save information about activity across Google services and apps, and reporting on the case highlighted that it could also involve location data .
That distinction has long been a source of user confusion. Malwarebytes noted that turning off Location History did not necessarily stop Google from recording some location information because Web & App Activity was a separate setting . Softonic’s summary of the decision made the same point, describing the gap between disabling Location History and the continued saving of location signals through Web & App Activity as one of the practical issues behind the ruling .
For regulators, such design complexity can become a fairness and transparency problem. If an ordinary user believes that one prominent location control stops location tracking, but another account-level activity setting continues to collect location-related data, the legal question becomes whether consent, notice and control are meaningful in practice. The DPC’s findings suggest that the answer, for the 2018–2020 period under investigation, was no .
A long inquiry, and a broader enforcement pattern
The DPC opened the inquiry in February 2020 after complaints from several European consumer rights organisations, including BEUC, about Google’s processing of location data . The European Post reported that the case followed coordinated complaints lodged in late 2018 by consumer organisations in multiple European countries, with BEUC at the centre of the effort . That timeline means the enforcement outcome arrived years after the first wave of complaints, a delay privacy advocates are likely to cite in the continuing debate over the speed of cross-border GDPR enforcement.
The decision also fits into a broader pattern of scrutiny over Google’s handling of location information. Malwarebytes noted that related location-tracking issues had previously led to settlements and payouts in multiple U.S. jurisdictions, including Arizona, a 40-state settlement, Washington state and Texas . Those U.S. matters are legally separate from the Irish GDPR decision, but they show that location settings have been a recurring source of legal risk for Google across jurisdictions .
In Europe, the Irish penalty is notable because it comes from the regulator that often acts as lead supervisory authority for major technology firms whose EU headquarters are in Ireland. Betanews reported that the €403 million fine is the fourth-largest penalty the DPC has issued against a large technology company and part of more than €4 billion the regulator has imposed since taking on that role under the GDPR framework .
What it means for users
For users, the immediate lesson is not that every Google location feature is unlawful today. The decision concerns a defined historical period, and Google says its policies and tools have changed since then . But the case does reinforce a practical point: location controls can be split across multiple settings, and turning off one feature may not be the same as stopping every form of location-related processing .
Users who want to reduce location-based data collection should review Web & App Activity, Location History, Timeline and any location-related ad settings in their Google account. Malwarebytes specifically advised users to check Web & App Activity and other related settings, and to delete saved activity where appropriate . The broader takeaway is that privacy controls should be checked as a system, not as isolated switches.
What it means for companies
For companies, the Irish decision is a warning about evidence. It is not enough to publish a privacy notice, display a consent prompt or maintain a retention policy if the organisation cannot prove that the product, the data pipeline and the deletion process behave consistently with those statements. The DPC’s summary identifies failures across lawfulness, fairness, transparency, accountability and retention, which means the regulator looked at the whole chain of processing rather than a single interface .
Any business that collects precise or inferred location data should be able to answer five questions: what signals are collected, what legal basis applies, how users are informed, how choices are enforced technically, and when the data is deleted. If those answers live in separate legal, product and engineering documents that cannot be reconciled, the company may face the same kind of accountability gap identified in the Google decision .
The next phase
The next milestones are straightforward. Google must meet the six-month compliance order, and the DPC is expected to publish the full decision in due course . Once the full decision is available, privacy professionals will be able to assess the precise reasoning behind the penalty and the operational changes required.
For now, the message is already clear. Ireland’s regulator has treated location data as a high-sensitivity category requiring clear explanation, lawful and fair handling, demonstrable accountability and disciplined retention. Google’s €403 million fine is therefore more than a headline number: it is a test of whether major digital platforms can make complex location-data systems understandable and controllable for the people they track.