Irish regulator fines Google €403m over processing of users’ location data

Ireland’s Data Protection Commission (DPC) fined Google €403m over its processing of users’ location data. The regulator ordered the company to bring the practices into compliance with the EU’s General Data Protection Regulation within six months.

The ruling covers 25 May 2018 to 4 February 2020 and examines web and app activity, location history and location accuracy. The DPC said users may not have understood that their data could be used to influence them through advertising or to infer their interests and health information.

Complaints over location settings

The inquiry followed complaints from seven European consumer organisations. Their case relied on research by Norway’s consumer agency, which said in 2018 that Google used various techniques to keep location history and web and app activity enabled.

The research said location data could reveal visits to places of worship, demonstrations, hospitals or certain bars, potentially indicating religious beliefs, political views, health conditions or sexual orientation.

DPC deputy commissioner Graham Doyle said location data can improve online services but can also disclose significant private information. He said retaining the data for longer than necessary aggravated users’ loss of control over their personal information.

Google and consumer groups respond

A Google spokesperson said the case concerned historical policies that had since been updated. The company said it had significantly changed its practices from 2019 and introduced tools to make location-data management easier.

The European Consumer Organisation (BEUC) called geolocation data one of the most invasive forms of consumer surveillance. Its director general, Agustín Reyna, welcomed the ruling but said the time taken to reach it was disproportionate to the seriousness of the infringement.

The penalty is the fourth-largest imposed by the Irish regulator, which oversees major US technology companies with EU headquarters in Ireland. It previously fined Meta €1.2bn, TikTok €530m and Instagram, which is owned by Meta, €405m. Three other large-scale statutory inquiries concerning Google remain at an advanced stage.