EU Regulator Hits Google with €403 Million Fine Over Location‑Data Practices

Ireland's Data Protection Commission (DPC) has imposed a €403 million penalty on Google, concluding that the tech giant breached the European Union's General Data Protection Regulation (GDPR) in the way it processed users' location information across three of its services between May 2018 and February 2020.

The investigation focused on how Google collected, stored, and used precise location data without obtaining the explicit consent required under GDPR. The DPC found that the company failed to provide clear, granular options for users to opt out, and that the data was retained longer than necessary for the purposes advertised. The violations span several popular Google features that rely on geolocation, though the regulator did not name the specific products in its public statement.

As the lead supervisory authority for Google in the EU, the Irish DPC coordinated the case under the GDPR's cross‑border enforcement framework. The commission said the breaches demonstrated a systematic disregard for the law's transparency and data‑minimisation principles, prompting the sizable sanction intended to serve both punitive and deterrent functions.

At €403 million, the fine ranks among the largest ever levied for GDPR infringements, underscoring the growing willingness of European regulators to impose substantial monetary penalties on tech firms. The amount reflects the severity of the violations, the duration of non‑compliance, and Google's global revenue, as required by the regulation's tiered penalty structure.

Google has indicated that it will review the decision and consider appealing the fine. The company has previously contested other EU enforcement actions, arguing that its privacy controls meet legal standards. Regardless of the outcome, the case reinforces the expectation that large platforms must embed robust consent mechanisms and data‑retention policies into their products.

Privacy advocates view the ruling as a milestone in the EU's broader effort to tighten oversight of digital services that handle personal data. The decision may prompt other regulators to scrutinize similar practices across the industry, potentially leading to more audits, corrective orders, or fines. For users, the case highlights the importance of understanding how location data is used and the rights afforded by GDPR, while firms are reminded that compliance is increasingly monitored and enforced at a substantial financial cost.