Google fined €403 million over handling of users’ location data
Where it stands
Ireland’s Data Protection Commission has fined Google €403 million over its handling of location information. The decision announced on 21 September 2026 concerns practices between 25 May 2018 and 4 February 2020. It covers three features: Web & App Activity, Location History and Location Accuracy. The regulator found problems with legal compliance, explanations to users and keeping some location data longer than necessary. Google has six months to bring the processing covered by the order into compliance. The practical issue is whether people could understand and control how information about their movements was used. Different settings can handle location information for different purposes, so switching off one feature need not stop every other use. Google says the decision concerns older policies and that it has improved its privacy controls. The finding is not a ban on maps or every use of location technology. It also does not itself establish an automatic compensation payment for individual users.
Background
A phone can use location information to place someone on a map or provide nearby results. The same broad category of information can also become part of a record of activity. Knowing where a person is for a current service and retaining a history for later use are different activities. Privacy depends partly on whether the person can understand those differences and the choices available. Google’s location features have served different functions. Location History recorded places visited; Web & App Activity could include location information alongside activity on services. Location Accuracy helped improve a device’s estimate of its position. The inquiry examined how these features handled personal data during a specified historical period. Current settings and product names should not be assumed identical to those used then. Under the EU’s General Data Protection Regulation, useful technology does not remove duties concerning personal information. Processing needs a lawful basis, must be fair and must be explained transparently. Keeping information also needs justification: data should not simply remain stored indefinitely because collection was once permitted. Organisations must be able to demonstrate that they meet their obligations. This is why a privacy investigation examines more than whether a device can technically find its location. It asks what information was collected, how it was used, what users were told and how long it was retained. Complaints from European consumer organisations led the Irish regulator to open this inquiry in February 2020. The new decision turns that inquiry into a financial penalty and a requirement to correct the processing.
How it developed
-
February 2020; location-data inquiry openedHow it started
Consumer complaints lead to an examination of three location features
The Irish regulator opened its inquiry following complaints from European consumer-rights organisations. It examined Google Ireland’s processing through three location-related features during the period covered by the investigation. The inquiry concerned the handling of personal information, not simply the accuracy of a map. That distinction matters because a technically useful service can still present problems with explanation, legal justification or retention. Users need to understand what a setting controls before a choice about that setting becomes meaningful.
-
21 September 2026; decision and compliance orderOfficial response
The regulator separates unlawful processing from failures to demonstrate compliance
The Commission found lawfulness and fairness breaches involving Web & App Activity and Location History. For Location Accuracy, the finding concerns accountability: Google failed to demonstrate compliance with the lawfulness, fairness and transparency principle. The regulator also identified transparency problems across the features and retention breaches involving Web & App Activity and Location History. The fines total €403 million, with a six-month period to bring processing into compliance. Google says the decision concerns older policies and points to improvements in its privacy controls. The announcement does not show that corrective work is already complete. Nor does it establish that every collection of location data is unlawful.
Why it matters for UPSC
For GS2 and GS3, distinguish a technology’s useful function from the rules governing its use of personal data. Connect lawful processing, transparency, retention and accountability. An EU regulatory decision is not an Indian legal order. Historical findings also do not establish how every current setting works.
Key terms
Sources (3)
- Data Protection Commission · official · Google fined €403 million following location-data inquiry
- Google · official · Manage your Timeline data
- Business Standard / Associated Press · Google fined for breaching EU privacy rules on location data