Leadership2 publishers2 min readPublished
Ireland's DPC puts a €403m price on 620 days of Google location processing
The Data Protection Commission found four kinds of GDPR infringement across three location features and gave Google six months to comply. It has not yet published the full decision that says what complying means.
The Board Room · Leadership desk
What happened
- Ireland's Data Protection Commission announced €403m in fines against Google Ireland on 21 September 2026, closing an own-volition inquiry it opened in February 2020 after complaints from consumer groups including BEUC.
- The inquiry covered three features, Web & App Activity, Location History and Location Accuracy, and only the processing that took place between 25 May 2018 and 4 February 2020.
- Google said the case concerns historical policies that have since been updated, and that it has significantly evolved its practices from 2019 onwards.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- constraint Documentation becomes the deliverable for any feature whose lawful basis is arguable: a lead supervisory authority can test the evidence file long after the flow itself was retired, and an inability to produce it attracted a finding here on its own.
- decision Google has to decide what to change before the reasoning is public, because the six-month clock started with the announcement while the full decision is still to be issued.
- contradiction Google calls the policies historical and updated from 2019, yet the DPC ordered present processing brought into compliance, so the two accounts cannot both describe the current state of the three features.
- exposure The Guardian reported three further DPC inquiries into Google at an advanced stage, so buyers reviewing Google services should expect more findings from the same regulator inside the same cycle.
The fine covers a fixed window, so it divides cleanly. From 25 May 2018 to 4 February 2020 is 620 days [1], and €403m over 620 days is about €650,000 for each day in scope [2].
The lawfulness and fairness finding does not cover all three features. It applies to Web & App Activity and Location History [4]. For Location Accuracy the DPC found that Google failed to be able to demonstrate compliance with the lawfulness, fairness and transparency principle [5]. Location Accuracy is an Android operating system feature available to Android users whether or not they hold a Google Account [11].
Retention came in as a separate infringement. The DPC found against Google's retention of location data in Web & App Activity and Location History [7], and Deputy Commissioner Graham Doyle said: "The retention of users' location data for longer than necessary aggravated this loss of control" [10].
The complaint that started the file was about how the choices were presented. According to the Guardian, BEUC based it on research by the Norwegian consumer agency claiming Google used "various tricks" to ensure Location History and Web & App Activity were enabled [20]. That 2018 research suggested location data could reveal religious belief from visits to places of worship, political leaning from attendance at demonstrations, health conditions from hospital visits and sexual orientation from visits to certain bars [17].
Google's answer is that the conduct is old. A company spokesperson said: "This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple" [12]. The DPC still ordered Google to bring its processing into compliance within six months of 21 September 2026, which puts the deadline in late March 2027 [8][5]. The regulator said it will issue the full decision in due course [9].
The lag is the part other controllers should price. The inquiry opened in February 2020 and the decision arrived on 21 September 2026, six years and seven months later [3]. Agustin Reyna, director general of BEUC, welcomed the ruling but said "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement", arguing that "late enforcement can be as harmful as no enforcement at all" [13].
€403m is the fourth-largest fine the Irish regulator has imposed [14]. It trails €1.2bn against Meta, €530m against TikTok and €405m against Instagram [15], landing €2m under the Instagram figure [4]. The Guardian reported that three other large-scale statutory inquiries into Google are open, all at an advanced stage [16].
What to watch
- The full decision text from the DPC, and whether it identifies which current Google settings fall short of the GDPR.
- Whether Google's changes by the late-March 2027 deadline are accepted by the DPC or contested.
- The three advanced-stage DPC inquiries into Google, and whether their fines land above or below €403m.