Ireland prices Google's location-data window at about 650,000 euros a day

Divide EUR 403m by the 620 days between May 25, 2018 and February 4, 2020, the window Ireland's Data Protection Commission investigated. That is EUR 650,000 a day, the regulator's price for failing to tell users how their whereabouts were tracked ^{[1][3][1][2][4]}.

Set that against the statutory ceiling and it shrinks. GDPR allows fines of up to 4% of global annual revenue ^[11]. Alphabet reported more than $300bn for its most recent fiscal year ^[12], so 4% is $12bn or more ^[3]. Crypto Briefing gives the fine as roughly $463m ^[2], which works out to about 3.9% of that ceiling and about 0.15% of a single year's revenue ^[4][5].

The commission's finding is about what users were told. It concluded Google breached GDPR requirements on lawfulness, fairness, transparency and accountability, after complaints from several European consumer rights organisations opened the inquiry ^[6][5]. Deputy Commissioner Graham Doyle said, "Location data is personal data, and users must maintain control over how it is utilized by corporations like Google." ^[7]

Google has six months to bring its location-data practices into full compliance ^[8], and by Crypto Briefing's account it had already changed its location settings and consent flows after the period under review ^[16]. The report does not say whether Google will appeal.

Two readings fit the same number. The first: 0.15% of a year's revenue, for conduct that stopped in February 2020, is a backward-looking bill. The rational response is to accrue for it and keep the product roughly as it is. The second is the more interesting one. The cheque is the smaller item and the six-month order is the costly one, because a consent screen that fewer users accept removes location signal from ad targeting for as long as the order stands.

I'd expect the first. The DPC is lead privacy supervisor for most US tech giants in Europe because Ireland's low corporate tax rate made Dublin their European base ^[10][15]. Other member states and privacy advocates have spent years criticising that same regulator as too slow and too lenient toward those companies ^[14]. This is its fourth-largest GDPR fine since 2018 ^[9]. One decision covering one 620-day window leaves a rival's finance team with nothing to accrue against ^[1].

What would change that view is testable in either direction. If the DPC's next transparency decisions against other Dublin-headquartered firms land in the same range, the penalty becomes a budget line. It gets priced like any other levy. If instead the compliance work Google must finish inside six months shows up as weaker European ad yield, then EUR 403m was the smaller of the two costs in the ruling ^[8].