Irish Regulator Fines Google €403 Million Over Location Data Tracking

When the Irish Data Protection Commission fined Meta €1.2 billion in 2023, the penalty centered on the cross-border transfer of user data to the United States. Google’s new €403 million fine, handed down this week by the same regulator, hinges on a different mechanism: the internal architecture of the company's own settings menus. The six-year inquiry concluded that Google violated the General Data Protection Regulation (GDPR) by obscuring how it collected, used, and retained the location data of its European users between May 2018 and February 2020.[1][4]

The investigation, which acts as the lead regulatory action for the European Union, examined three specific Google features: "Web & App Activity," "Location History," and "Location Accuracy." Regulators found that the company failed to meet the GDPR's standards for lawfulness, fairness, and transparency. According to the Data Protection Commission (DPC), Google's interface design left individuals unaware that their location was being used to infer their personal interests and influence the advertisements they were shown.[2][4][7]

The core technical issue involved the interplay between different account settings. Security analysts noted that users who explicitly turned off the "Location History" toggle might have assumed their movements were no longer being tracked. However, the separate "Web & App Activity" setting—which is often enabled by default—continued to collect and store location data in the background. This overlapping architecture meant that disabling a feature marketed as the primary location control did not actually stop the flow of location information to Google's servers.[5][6]

"Location data can bring both benefits and harms to individuals," said Graham Doyle, a deputy commissioner at the DPC. "It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private." The regulator emphasized that retaining this data for longer than necessary further aggravated the users' loss of control over their personal information.[4][7]

The inquiry was originally prompted in 2018 by complaints from several European consumer rights organizations, including the European Consumer Organisation (BEUC) and the Norwegian Consumer Council. These groups argued that Google was using deceptive design practices to manipulate users into agreeing to constant mobile tracking. The resulting €403 million penalty is the fourth-largest fine ever issued by the Irish regulator, which oversees many of the major U.S. technology companies that maintain their European headquarters in Dublin.[1][2][5]

Google has responded to the ruling by emphasizing that the DPC's findings relate to legacy systems. A company spokesperson stated that the case centers around historical policies that have since been updated, noting that Google has significantly evolved its practices since 2019. The company highlighted the introduction of new tools designed to make managing location data simpler, including auto-delete options and less precise location storage. However, the DPC's compliance order indicates that the regulator still requires formal verification that these newer tools fully resolve the underlying transparency failures.[2][3][4]

Despite these updates, the regulatory order requires Google to bring all of the data processing covered by the decision into full compliance with the GDPR within six months. The ruling adds to a growing list of location-data settlements for the company, which previously agreed to pay nearly $400 million to a coalition of 40 U.S. states in 2022 over similar tracking practices. Google now has until March 2027 to demonstrate to the DPC that its current location architecture meets the transparency standards established by this €403 million penalty.[4][5][6]

For the broader technology industry, the DPC's decision signals that regulators will increasingly penalize companies that rely on fragmented or confusing privacy controls to maintain data collection. The ruling establishes that providing an opt-out toggle is insufficient if the underlying system continues to harvest the same telemetry through secondary channels.[3][6]