DUBLIN — Ireland’s Data Protection Commission fined Google €403 million on Monday after finding that features used to collect and process location information had violated the European Union’s General Data Protection Regulation.
The decision covers Google’s Web & App Activity, Location History and Location Accuracy features during the period from 2018 through 2020. The regulator also ordered the company to bring the processing into compliance within six months.
Consent and control
The inquiry began in 2020 after complaints from European consumer groups. Regulators examined whether Google had a lawful and fair basis for collecting location information and whether users were adequately informed about how the data could be used.
The commission said the shortcomings could leave people unaware that their movements were influencing advertising or being used to infer their interests. The penalty is the fourth-largest imposed by the Irish regulator on a major technology company, which acts as the lead European privacy authority for many U.S. platforms with regional headquarters in Ireland.
Google said the case concerns historical policies and that its practices have changed significantly since 2019. The company pointed to tools that automatically delete information, keep timeline data on a device and give users additional controls over the use of data in advertising.
The enforcement signal
The ruling illustrates the reach of Europe’s one-stop-shop enforcement system and the long timeline of major GDPR investigations. It also separates product improvements from legal responsibility for earlier practices — later changes may reduce ongoing harm, but they do not erase an infringement during the period under review.
Google remains the subject of three other Irish statutory inquiries described by the regulator as being at an advanced stage.
Location data receives special scrutiny
A map coordinate can look like a technical detail, but a sequence of coordinates can reveal a home, a workplace, medical visits, religious observance and intimate relationships. European privacy law therefore examines not only whether a company presented a consent screen, but whether the entire processing operation was lawful, fair and understandable to an ordinary user.
The distinction among Google’s three features is important. A user may reasonably understand “Location History” as a record of movement while failing to appreciate that Web & App Activity or device-level accuracy settings can also contribute location signals. If settings overlap, a nominal choice in one menu may not give effective control over the combined system.
The commission’s compliance order can require more than revised wording. A durable remedy may involve default settings, the separation of purposes, retention periods, advertising controls and proof that a person can refuse one form of processing without losing an unrelated service.
Ireland’s role in European enforcement
The GDPR’s one-stop-shop system generally gives the regulator in a company’s main European establishment a leading role in cross-border cases. For many large American technology companies, that regulator is Ireland. The structure is intended to produce a single coordinated decision, but it has also drawn criticism when investigations take years.
A large fine signals seriousness; the six-month compliance deadline may have the more lasting effect. If Google appeals, courts may review the regulator’s legal reasoning, calculation of the penalty and handling of European cooperation. An appeal does not necessarily suspend every remedial obligation.
What users and companies should watch
For users, the practical measure of the decision will be whether controls become easier to understand and whether deletion truly reaches derived profiles as well as raw location points. For companies, the ruling is a warning against treating product settings as isolated silos when data flows across a larger advertising and analytics system.
The case also shows why “historical” conduct remains legally significant. Technology products can change before an inquiry ends, but regulators still assess the rules and interfaces that governed data at the time it was collected. Later improvements may affect the remedy; they do not automatically legalize the past.
