DUBLIN — The inquiry was prompted by complaints from seven European consumer organisations, including the Norwegian Consumer Council and the European Consumer Organisation (BEUC). The investigation covered the period from May 25, 2018, to February 4, 2020. Graham Doyle, Deputy Commissioner, said "location data can bring both benefits and harms to individuals."

Google stated it has introduced simple ads management allowing users to turn off personalized ads entirely. This is the fourth-largest privacy fine issued by the Irish Data Protection Commission. The €403 million penalty is the fourth-largest penalty the Protection Commission (DPC) has issued since the GDPR took effect, according to reports.

Why It Matters

The fine represents a significant enforcement action under the General Protection Regulation, targeting how major technology companies handle sensitive user information. By focusing on location data, the regulator addressed concerns that individuals lost control over personal information used for advertising and interest inference without clear awareness.

This decision fits into a broader pattern of regulatory scrutiny of digital platforms in Europe. With three other ongoing statutory large-scale inquiries involving Google, the Protection Commission continues to examine compliance across the company's operations. The order to achieve compliance within six months sets a specific timeline for operational changes.

Timeline

On September 21, 2026, the Protection Commission found that Google did not lawfully or fairly process location data in its Web & App Activity, Location History, and Location Accuracy features. The commission stated that as a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. Also on September 21, 2026, Google stated it has introduced industry-first auto-delete controls allowing users to set accounts to automatically delete data on a rolling three, 18, or 36-month basis.

A Google spokesperson said from 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.

What's New

Further reporting indicated the retention of users’ location data for longer than necessary aggravated this loss of control. According to reports, the €403 million penalty is the fourth-largest penalty the Protection Commission (DPC) has issued since the GDPR took effect. The Protection Commission ordered Google to bring its data processing into compliance with the GDPR within six months.

Finn Myrstad said today marks an important milestone in the effort to protect our rights online. Myrstad added people must be able to understand what they are agreeing to without being deceived or manipulated into making choices they otherwise would never have made.

How Sources Differ

Sources differ on the ranking of fines within the Protection Commission's history. The Ireland Protection Commission enforcement decision states Ireland’s Protection Commission fined Google 403 million euros ($463 million) for breaching the EU's General Protection Regulation. The Ireland Protection Commission enforcement history notes the Protection Commission has previously fined Meta 1.2 billion euros, TikTok 530 million euros, and Instagram 405 million euros.