On 21 September 2026, Ireland’s Data Protection Commission (DPC) fined Google €403 million (£345m) over how it handled location data, one of the largest penalties the Irish regulator has issued. The decision followed an inquiry opened six years earlier, after complaints from several European consumer rights organisations.
The investigation covered three features, Web & App Activity, Location History and Location Accuracy, and specifically how Google processed location data through them between 25 May 2018, the day UK and EU GDPR took effect, and 4 February 2020.
What the DPC actually found
The ruling is more specific than “Google broke GDPR”. The DPC found that processing through Web & App Activity and Location History failed the lawfulness-and-fairness standard, that Location Accuracy separately failed the accountability standard, and that all three features fell short on transparency.
DPC deputy commissioner Graham Doyle said location data “can reveal a significant amount of information about an individual, including information that is inherently private”, and that GDPR “requires that the processing of personal data must be carried out in a lawful, fair and transparent manner”. As a result of Google’s failures, he said, “individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data”, adding that “the retention of users’ location data for longer than necessary aggravated this loss of control”.
Alongside the fine, Google has been ordered to bring its data processing into compliance within six months.
Google’s response
Google said: “This case centres around historical policies that have since been updated. From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.” It pointed to “industry-first auto-delete controls” that let users set their account to automatically delete location data on a rolling three, eighteen, or thirty-six month basis, a “simple ads management” option to turn off personalised ads entirely, and “increased transparency” around its location data practices and account settings.
The number is bigger, and smaller, than the headline suggests
€403 million is a genuinely large fine on its own terms, but it is worth putting next to two other figures. The DPC has now issued more than €4.4 billion in GDPR fines since 2018, and sits behind eight of the ten largest GDPR fines ever handed down, a position it holds largely because so many US tech firms base their EU operations in Ireland. Of that €4.4 billion, only around €20 million has actually been collected.
The gap exists because, under Irish law, a DPC fine does not become payable until it is confirmed by a court, and almost every large fine gets appealed. Google’s €403m penalty is recorded as “not confirmed”, the same status as a €91m Meta fine from 2024 and a €225m WhatsApp fine dating back to 2021 that is still unresolved. In practice, that means the headline number is a starting position in a legal process that can run for years, not a cheque that gets written the following week.
None of that makes the ruling less significant. The reasoning behind it, not the final amount Google eventually pays, is the part that sets a precedent other regulators and other companies will be reading closely.
Why this matters if you are not Google
This is an EU GDPR decision from Ireland’s regulator, not a UK ICO ruling, so it does not apply to a UK-only business directly. It is still worth paying attention to for the same reason EU regulatory guidance on anonymisation was worth reading in a UK context: UK GDPR shares the same underlying text and concepts, and the ICO pays close attention to how the EU’s most active data protection regulator reasons through a case like this.
- Retention was named explicitly as an aggravating factor. Keeping location, or any, personal data for longer than you need it is not a technicality, it actively makes any other failing worse in a regulator’s eyes. See our note on keeping data forever as one of the most common small business mistakes.
- Transparency failed across all three features, not just one. If your website or app uses Google Analytics, Google Ads, or any tool that can infer a user’s location, the obligation to be clear about that processing sits with you as the data controller, not just with Google as the processor or platform.
- “It is used to personalise ads” is not, on its own, a lawful basis. The DPC’s finding turned partly on lawfulness and fairness, not just disclosure. Being transparent about processing you should not be doing at all does not fix the underlying problem.
You do not need Google’s scale to make the same mistakes. A smaller business is far less likely to face a nine-figure fine for it, but the same questions, what you collect, how long you keep it, and whether people were actually told, are exactly what our free GDPR check walks through in a couple of minutes.