Ireland Closes an Eight-Year Google Location Case for €403 Million

Ireland’s Data Protection Commission fined Google Ireland Limited €403 million on 21 September 2026 for mishandling location data. The $463 million penalty covers three features used from 25 May 2018 to 4 February 2020.

Consumer groups first complained in November 2018. Google says those policies have already been rewritten, yet the DPC still gave the company six months to bring the processing into line, and it has not published the full decision.

Four GDPR Failings Across Three Location Features

The decision is the DPC’s first major fine against Google. Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney signed off four GDPR counts after an own-volition inquiry opened in February 2020, when Ireland acted as lead supervisory authority for Google in the EEA.

Deputy Commissioner Graham Doyle said location data can improve online services and can also reveal information that is inherently private. People could have been unaware their whereabouts were used to influence them with ads or to infer their interests, he said, and keeping that data longer than necessary made the loss of control worse.

The DPC imposed administrative fines totalling €403 million and ordered Google to bring its processing into compliance within six months. It thanked other European supervisory authorities for their help and said the full decision will follow in due course.

THE THREE FEATURES AND THE GDPR COUNTS

Web & App Activity, when switched on, lets Google process activity on its services, including browsing history, search history and location data. Location History infers place visits, activities and the paths between them, and it keeps that private map even when the user is not in a Google app.

As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control.

Graham Doyle, Deputy Commissioner, Data Protection Commission, 21 September 2026

The DPC posted a video summary of the same decision on its official account.

📢 New Decision
Data Protection Commission fines Google €403 million
following inquiry into Google’s processing of location data pic.twitter.com/bPZv8kElKg

— Data Protection Commission Ireland (@DPCIreland) September 21, 2026

Consumer Groups Waited Close to Eight Years

The file did not start in Dublin in 2020. On 27 November 2018, eight consumer organisations in Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland, Sweden and Denmark, coordinated by the European Consumer Organisation (BEUC), filed complaints against, or reported, the way Google tracked locations.

BEUC now calls the ruling good news for consumers, and close to eight years after complaints first went in. The DPC opened its statutory inquiry 434 days later, on 4 February 2020, the same date that closes the processing window it examined. From that opening to the fine is more than six years.

FROM THE 2018 COMPLAINTS TO THE 2026 FINE

1. 25 May 2018: The GDPR starts to apply, and the DPC’s later inquiry window opens on this date.
2. 27 November 2018: BEUC members, led by research from Norway’s Forbrukerrådet, take Google’s location settings to national data authorities.
3. 4 February 2020: The DPC opens an own-volition inquiry into Google Ireland Limited and cuts the examined period off on this day.
4. 12 December 2023: Google says Maps Timeline will move onto the phone, with a three-month auto-delete default.
5. 21 September 2026: The DPC announces the €403 million decision and a six-month compliance order.

The 2018 work sat on Forbrukerrådet’s report “Every Step You Take,” which argued Android owners were steered into round-the-clock tracking. Gro Mette Moen, then acting head of digital services at the Norwegian Consumer Council, said Google was processing detailed personal data without proper legal grounds, and that the data had been acquired through manipulation techniques.

HOW THE 2018 COMPLAINT SAID ANDROID USERS WERE STEERED

• Deceptive click-flow: Device setup pushed people into enabling Location History without a clear sense of what they had switched on.
• Hidden defaults: Web & App Activity sat behind extra clicks at account setup and came enabled by default.
• Thin information: The complaint said users were not told enough at the choice point, including that location could feed advertising.
• Repeated nudges: Google services kept asking people to turn Location History on after they had already declined it.
• Bundled extras: Features such as Google Assistant and photos sorted by place were tied to invasive location tracking, the groups said.

Forbrukerrådet published that list as deceptive design and misleading information on 27 November 2018. BEUC says Google later changed its platform worldwide because of the complaint, then argues those changes were not enough: the network filed a second complaint in 2022 on deceptive design.

France’s CNIL had already fined Google €50 million in January 2019 over information and consent for targeted advertising, a case Forbrukerrådet pointed to while it waited on Dublin. The Irish decision is the one that finally prices the location settings themselves under the one-stop-shop.

The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data. However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement. Late enforcement can be as harmful as no enforcement at all.

Agustín Reyna, Director General, European Consumer Organisation (BEUC)

Reyna also said Google had tracked hundreds of millions of European consumers for years. Location data, he said, can show where children go to school, how often someone visited a hospital, or a place of prayer.

What Location Accuracy Does Without a Google Account

Location Accuracy is an Android feature that helps a phone fix its position with more than GPS, and the DPC says it is available whether or not the user has a Google Account. That is the piece of the case that reaches people who never signed in, and it is the one count built on accountability: Google could not show it had met the lawfulness, fairness and transparency principle for that processing.

Web & App Activity is different. It exists only for account holders. Location History requires an opt-in, then builds a Timeline of visits and routes on signed-in devices. The DPC still found the company failed its transparency duties on all three features, so the account wall did not save Location Accuracy from the same information problem.

The advertising use is the part Doyle put in plain words. Location was not only a map convenience. It could be used to show ads or to guess interests, and users might not have known. BEUC describes geo-location as one of the most invasive forms of commercial surveillance, because it can reveal religious belief, health, political opinion or sexual orientation from the places a person goes.

The examined window stops on 4 February 2020. Anything Google changed after that date is outside the findings of fact, which is why the company’s “historical policies” line and the six-month order now sit in the same press cycle.

After 2019, Google Rebuilt the Location Switches

A Google spokesperson said the case centres around historical policies that have since been updated. “From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” the spokesperson said.

The company points to auto-delete controls that let users set account data to erase on a rolling three, 18 or 36-month basis, ads settings that can turn personalised ads off, and clearer information about location practices. It also says it stores an estimated general area, not a precise device location, in Web & App Activity, and that Maps Timeline data now lives on the device, with older than three months removed automatically.

In a 12 December 2023 Maps post, Google said Timeline saved right on your device would replace the older cloud copy for people who had turned Location History on (off by default, the post said). When a user first switched the setting on, auto-delete would default to three months; it had been 18 months. Encrypted cloud backup stayed optional. The change was to roll out through the following year on Android and iOS.

Those dates do not wipe the inquiry. The DPC’s window runs to 4 February 2020, so part of the period it judged overlaps the years Google now cites as the rebuild. The findings look back. The order looks forward. Until the full decision is out, it is not possible to see which current settings Dublin still treats as non-compliant, or whether the six-month clock is mostly a formal wrap on 2018-2020 processing.

Alphabet can pay €403 million without blinking. The part that can still change a phone in someone’s pocket is the unpublished compliance order, not the headline number.

Fourth on Ireland’s Fine List, First Against Google

Among DPC penalties, €403 million sits fourth, €2 million under the Instagram children’s-data fine. It is also the first time this regulator has hit Google at this scale, after years of nine-figure decisions against Meta, TikTok, LinkedIn and WhatsApp.

IRELAND’S LARGEST DPC FINES

The Instagram figure is the nearest neighbour, which is why the ranking is tight. Meta’s €1.2 billion transfer decision from 2023 remains the DPC record. TikTok’s €530 million decision from 2025 is second. Google’s new line is the first time search and Android, rather than social apps, take a comparable Irish GDPR hit.

How Much of Ireland’s GDPR Fines Has Been Collected

The DPC’s own fines page, last updated 10 August 2026, says over €4 billion has been levied and that approximately €20 million in fines collected has actually reached the state. That page does not yet list the Google decision, which came five weeks later.

WHAT IRELAND HAS LEVIED AND WHAT IT HAS BANKED

• Levied: Over €4 billion from DPC inquiries, on the commission’s own running total.
• Collected: Approximately €20 million, according to the same DPC ledger.
• Big-tech status: The Meta €1.2 billion, TikTok €530 million and Instagram €405 million decisions are all listed as pending appeal.
• The legal gate: Under the Data Protection Act 2018, a DPC fine is not payable until a court confirms it.

If nobody appeals, the DPC must still go to the Circuit Court to confirm the fine. If someone does appeal, the money cannot be collected while that case runs, in the Circuit Court or the High Court depending on the amount. After confirmation, the DPC issues a payment notice with 28 days to pay, then sends the cash to the Exchequer.

That is why a €403 million headline can sit for years next to a collected pot of approximately €20 million. Google has not confirmed whether it will appeal. Until it does, or until a court confirms the penalty, the figure is an administrative decision, not a cheque that has cleared.

The DPC still has to publish the reasoned decision, and Google still has six months to bring the processing into line. Those two documents, more than the fine itself, will show whether Maps Timeline on the phone and Android’s Location Accuracy toggle are treated as finished business or as work Dublin has not accepted yet.