Google Penalized Over Location Data Practices
Google has been fined €403 million ($463 million) by Ireland’s Data Protection Commission (DPC) following an investigation into how the technology company processed users’ location data.
The decision, announced on Monday, September 21, 2026, found that Google had breached the European Union’s General Data Protection Regulation (GDPR) through several features connected to location tracking and user activity.
The investigation examined Google’s practices between 2018 and 2020. The affected features included Web & App Activity, Location History and Location Accuracy.
The Irish regulator serves as the lead data protection authority for many major technology companies because they operate their European headquarters in Ireland.
Investigation Focused on User Consent and Transparency
According to the DPC, Google’s processing of location data raised concerns about whether users fully understood how their information was being collected and used.
The regulator said individuals might not have been aware that their location data could be used to influence advertising or help infer their interests. It also stated that Google’s practices could reduce users’ control over their personal information.
The investigation began in 2020 after complaints were submitted by several European consumer rights organizations, including the pan-European consumer group BEUC.
The DPC examined the lawfulness and fairness of Google’s location data processing, particularly through account settings that collect information about users’ activities and movements.
The regulator has also ordered Google to bring its location data processing into compliance with European privacy laws within six months.
Google Says Its Privacy Tools Have Improved
Google described the case as relating to historical policies. The company said it had significantly changed its approach to location data management since 2019.
A Google spokesperson stated that the company had introduced stronger tools to help users control their personal information.
Among the changes highlighted by Google are options for automatically deleting personal data on a rolling basis. Users can also store Timeline information directly on their devices and manage how their data, including location information, is used for advertising.
Google further stated that when users search for information, it stores an estimated general area rather than their precise device location.
These changes are intended to provide users with greater control over their location information and how it is processed across Google services.
One of the DPC’s Largest Technology Fines
The €403 million penalty is the fourth-largest fine issued by Ireland’s Data Protection Commission. The regulator has imposed more than €4 billion in total penalties since becoming the lead EU authority for several major US technology companies under the GDPR.
Google is also facing three separate statutory inquiries from the DPC, which the regulator said are at an advanced stage.
The latest decision highlights the continuing scrutiny faced by major technology companies over how they collect, process and use personal data.
For users, the case reinforces the importance of reviewing location settings, understanding privacy permissions and checking how personal information is used across digital platforms.