Privacy
Google fined €403 million for mishandling EU users’ location data
Google faces a €403 million fine from Ireland’s data regulator for mishandling EU users’ location data between 2018 and 2020. The case highlights the importance of transparent data practices under GDPR.
Ross GrantUpdated 3 min read
The short version
Google has been fined over €400 million by Ireland’s privacy regulator for not handling users’ location data properly in the EU. The case focused on how Google collected and used this data between 2018 and 2020. Google says it has since changed its practices. This shows how strict EU privacy rules are about personal data.
By the numbers
- €403 millionthe fine issued to GoogleSecurityWeek
- 2018–2020period covered by the investigationSecurityWeek
- 4th largestprivacy fine issued by Ireland’s DPCSecurityWeek
What happened?
Ireland’s Data Protection Commission fined Google €403 million ($463 million) for mishandling EU users’ location data between 2018 and February 2020. The regulator found Google did not process this data lawfully or transparently. Google says it has since updated its policies.
What led to the fine
Ireland’s Data Protection Commission (DPC) has fined Google €403 million (about $463 million) for breaking the European Union’s privacy rules. The DPC found that Google mishandled users’ location data in several key settings, including Web & App Activity (which tracks browsing and search history) and Location History (which records places users have visited with their phones). The investigation covered Google’s practices from 2018, when the EU’s General Data Protection Regulation (GDPR) took effect, until February 2020. SecurityWeek (opens in a new tab)
The DPC is the lead privacy regulator for Google in the EU, as the company’s European headquarters is in Dublin. This case is one of several major privacy actions the Irish regulator has taken against large tech firms.
What the regulator found
The DPC’s investigation concluded that Google did not process users’ location data lawfully, fairly or transparently. This included data collected through the Location Accuracy feature on Android devices. According to the DPC, Google’s handling of this data did not meet GDPR’s requirements for clear consent and transparency.
Deputy Commissioner Graham Doyle explained that location data can reveal sensitive information about individuals, such as their movements and private habits. While location data can make online services more useful, it also poses privacy risks if not handled properly.
Google’s response
Google said the case involved “historical policies that have since been updated.” The company stated that from 2019 onwards, it has made significant changes to how it manages location data. Google claims to have launched new tools that make it easier for users to control their location information.
The wider context
This is the fourth largest privacy fine issued by the Irish DPC, which has previously fined TikTok and Meta (Facebook’s parent company) even larger sums. The DPC said it still has three ongoing privacy investigations involving Google.
The GDPR allows regulators to fine companies up to €20 million or 4% of their global annual turnover, whichever is higher, for serious breaches. Fines of this size are meant to encourage companies to improve their privacy practices.
What users should know
If you use Google services in the EU, your location data is protected by GDPR. Companies must get clear consent and be transparent about how they use your data. You can check your Google account settings to control what location data is collected and stored. Google says it has improved these controls in recent years, but users should still review their privacy settings regularly.
What happens next
Google may appeal the fine, as companies often do in GDPR cases. The DPC’s decision may also prompt other regulators to look more closely at how tech firms handle sensitive data. Meanwhile, the DPC continues to investigate Google’s privacy practices in other areas.
Claimed vs confirmed
- Confirmed
Google fined €403 million for mishandling EU users’ location data.
Reported by SecurityWeek, citing the Irish Data Protection Commission.
- Confirmed
Google has updated its location data practices since 2019.
Google stated it has evolved its practices and launched new tools since 2019.
The impact
- Money
- The €403 million fine is one of the largest under the GDPR. Under EU law, fines can reach up to €20 million or 4% of a company’s global turnover for serious breaches.
- Reputation
- This case puts Google’s privacy practices under scrutiny and may affect public trust, especially in the EU where data protection is a major concern.
- Customers
- EU users’ location data was not handled transparently, but Google says it has improved controls. Users should check their privacy settings and be aware of how their data is used.
Why it matters
Millions of people in the EU use Google services. This fine shows that regulators are serious about enforcing privacy rights and that even large tech companies must follow strict rules about how they collect and use personal data.
How does it work?
The regulator found Google collected and processed users’ location data through features like Web & App Activity and Location History without clear consent or transparency, which violated GDPR rules on personal data handling.
Key points
- Google fined €403 million for mishandling EU users’ location data.
- The case covered data practices from 2018 to February 2020.
- Regulators found Google was not transparent or lawful in processing location data.
- Google says it has since improved its privacy controls.
- The fine is among the largest issued under the EU’s GDPR.
Sources
SecurityWeek
Reference
