Seven years and ten months separate the complaint from the penalty. On November 27, 2018, consumer organisations in seven countries filed coordinated grievances about the way Google collected location data on Android phones. On September 21, 2026, Ireland's Data Protection Commission fined Google Ireland Limited €403 million and gave the company six months to change the processing. In the interval, the products at issue were redesigned, the legal entity responsible for European users changed hands, a dozen adjacent cases were litigated in the United States, and the European Union began rewriting the statute under which the fine was issued.

That last point is what gives Monday its shape. Enforcement of the 2018 rulebook arrived on the same day that noyb published a Council of the European Union working text proposing to permit personal data processing for artificial intelligence training on a legitimate interest basis, with the Commission's proposed unconditional right to object struck out of the operative article. One instrument is being enforced against conduct from the last decade; the other is being loosened for conduct in the next. Meanwhile, in American courts, plaintiffs are reaching back to statutes from 1967 and 1988 to build a liability record that no legislature designed, and on the commercial side of the industry, targeting is quietly migrating to the places where consent is actually documented.

Dublin puts a price on six years of location processing

The decision covers a 620-day window: May 25, 2018, when the General Data Protection Regulation took effect, to February 4, 2020, when the DPC opened its own-volition inquiry under Section 110 of Ireland's Data Protection Act 2018. Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney issued it. Sweeney, who began a five-year term on October 13, 2025, spent eight years in public policy roles at Meta before joining the authority.

The DPC found four infringements across three features. Web and App Activity, an account-level setting, breached the lawfulness and fairness principles, violated transparency obligations and retained data beyond what was necessary. Location History, the opt-in feature for compatible mobile devices, failed on the same three grounds. Location Accuracy, which sits in the Android operating system rather than in an account, breached transparency and accountability: the regulator found Google unable to demonstrate compliance with lawfulness, fairness and transparency. No retention finding attached to that third feature.

Deputy Commissioner Graham Doyle framed the harm in commercial terms. Location data can greatly enhance the utility of online services, he said, but it can also reveal a significant amount of information about an individual, including information that is inherently private. Individuals, he added, could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests. Keeping that data longer than necessary, the authority concluded, aggravated the loss of control.

The origin of the case matters for what it reached. The 2018 complaints, coordinated by BEUC and built on the Norwegian Consumer Council report Every Step You Take: How deceptive design lets Google track users 24/7, cited Articles 5, 6, 7, 12, 13 and 25 of the GDPR. Forbrukerrådet, Consumentenbond, Ekpizo, dTest, Zveza Potrošnikov Slovenije, Federacja Konsumentów and Sveriges Konsumenter signed the template. It alleged that users had to refuse Location History at least four times across Google Assistant, Maps, the Search app and Photos, that Web and App Activity was enabled by default at account creation, and that advertising uses appeared only behind a Learn more link. It did not name Location Accuracy at all. The DPC found against that feature anyway, which is precisely the latitude an own-volition inquiry confers, and precisely the latitude Meta challenged before Ireland's High Court and lost on May 21, 2026, when all its grounds were dismissed.

Google's position is that the case is about history. A spokesperson said the matter concerns historical policies since updated, and pointed to changes from 2019 onward: auto-delete on three, eighteen or thirty-six month rolling cycles, controls to switch off personalised advertising entirely, management options for location data used in advertising, and the shift of Maps Timeline to on-device storage with default retention cut from eighteen months to three. The inquiry window runs to February 4, 2020, so part of that remediation falls inside the period examined and part after it. Whether the company appeals has not been stated.

For advertisers the operative finding is the retention one. Google's store visits conversions product, available in 36 countries, models footfall by observing signed-in users with Location History enabled who see an ad and later visit a business, then extrapolating. Storage limitation cuts directly into that modelling, and the direction of travel is already visible elsewhere in the stack: granular Google Ads reporting data was capped at 37 months from June 2026, and Customer Match list membership at 540 days since April 2025.

Two other numbers frame the penalty. At roughly $463 million it represents about 0.1 percent of Alphabet's 2025 revenues, which passed $400 billion for the first time. And it is the fourth-largest fine the DPC has issued, behind Meta at €1.2 billion in May 2023, TikTok at €530 million in April 2025 and ahead of LinkedIn at €310 million in October 2024. Collection is another matter. An Alliance Risk analysis from May 2026 found that nearly 40 percent of the €7.1 billion in GDPR fines issued since 2018 had been annulled or remained under active challenge, with Ireland accounting for 66 percent of all fine value; noyb reported in September 2025 that 0.6 percent of Irish fines against major companies had actually been collected. BEUC director general Agustín Reyna welcomed the decision while noting that the time taken was out of proportion to the seriousness of the infringement, and that late enforcement can be as harmful as none. Finn Myrstad of the Norwegian Consumer Council called it an important milestone.

Brussels rewrites the basis while Dublin enforces it

The document that landed the same day is Council text 12535/26, dated September 3, 2026, marked LIMITE, prepared for the Antici Group meeting of September 11 and published by noyb on September 21. It runs to 158 pages of compromise on the Digital Omnibus the Commission proposed on November 19, 2025.

The AI clause, renumbered Article 88 bis, permits processing of personal data in the context of the development and operation of an AI system or of an AI model on a legitimate interest of the controller or a third party in accordance with Article 6(1)(f). Three things were removed from the Commission's version. The carve-out for cases where other Union or national laws explicitly require consent is gone from the article. The language stating that the controller's interest yields where data subject rights override it, in particular where the data subject is a child, is gone from the article. And the four example safeguards are gone: data minimisation during source selection and model training, protection against disclosure of residually retained data, enhanced transparency, and an unconditional right to object to the processing of personal data.

Some of that reappears in a new recital 33a, which says processing may take place under Article 6(1)(f) where appropriate, except where such interests are overridden by data subject rights. Recitals are interpretive; operative articles are binding. Recitals 30 and 31 were deleted outright, and recital 31 is the one that referenced respecting technical indications embedded in a service limiting the use of data for AI development by third parties, which is the language covering the machine-readable signals publishers use against AI crawlers.

Germany wants to go further. Its written comments, reference WK 11020/2026 ADD 4 of August 17, 2026, propose that processing for the training and technical operation of an AI system as defined in Article 3, point (1) of Regulation (EU) 2024/1689 shall be presumed as a legitimate interest, which reverses the burden of the balancing test rather than merely preserving it. The German text would strike national from the consent carve-out so that only Union law could require consent, treat data collected for other purposes as presumed compatible with the initial purposes, and disapply Article 14 information duties and the Articles 16 to 18 rights to rectification, erasure and restriction where compliance proves impossible or would involve a disproportionate effort. It carves out public authorities, processing directed at identified individuals, and systems that synthetically generate voice, image or other characteristics of an identifiable person. Max Schrems, who chairs noyb, called the September text nothing but a digital expropriation of Europeans and the German submission a massive liberalisation.

The balancing test itself survives as the principal check, which places considerable weight on how well it is applied. An EDPB digest published in March 2026, reviewing 62 legitimate interest decisions, found that controllers routinely underestimate what that test demands.

Three further changes in the same text bear on advertising operations. Articles 88a and 88b, which would have moved device-access consent into the GDPR and required honouring machine-readable browser consent signals, have both been deleted; the Presidency removed 88b on June 18, 2026 and this draft removes 88a. In their place, a rewritten Article 5(3) of the ePrivacy Directive permits storage or access without consent for six purposes, among them anonymous aggregated audience figures, audience measurement under Article 24 of the European Media Freedom Act where data is pseudonymised immediately after collection, and a new one against the July text: contextual advertising measurement. That exemption covers measuring the display and performance of advertising based solely on the immediate content displayed during an individual visit to a single web page or on the basis of a single search query, with no profiling, no retention and no link to past or future activity.

Recital 44f then names frequency capping cookies, advertising audience measurement cookies and cookies to combat click fraud as examples. Frequency capping requires counting prior impressions, which is a link to past activity, and the operative text excludes exactly that. The conflict has not been resolved. A coalition of 19 organisations wrote to the Irish presidency and to co-rapporteurs Kaljurand and Salla on September 10 asking for the browser signal in Article 88b to be restored. Alliance Digitale, the French advertising trade body, had asked on May 21, 2026 for the contextual, frequency capping and fraud prevention exemptions that partially arrived.

Finally, the Council abandoned the Commission's plan to write identifiability criteria into Article 4(1) and built a new Article 25a instead. Pseudonymised data shall not be considered personal data for a person if that person is unable to identify the natural person to whom the data relates, and a natural person is not identifiable where the likelihood of identification is insignificant in practice. Data a processor handles remains personal data for that processor, and where third parties hold or can reasonably obtain the means of identification, transmission and their processing count as processing of personal data. The construction tracks the Court of Justice judgment in EDPS v Single Resolution Board of September 4, 2025 rather than the Commission's drafting, and the criteria will come through an EDPB opinion rather than implementing acts. The Board's consultation on anonymisation guidelines, 02/2026, closes October 30, 2026. Separately, breach notification moves from 72 to 96 hours and applies only to high-risk breaches, and Article 12(5) lets controllers charge or refuse where an abusive intention on the part of the data subject can be demonstrated.

American plaintiffs are litigating under statutes older than the web

While Brussels argues about the basis, the United States is generating privacy liability without new legislation at all. Müge Fazlioglu, principal researcher at the International Association of Privacy Professionals, put figures on it in an interview with AdExchanger published September 21: more than 10,000 data privacy cases filed in US courts since 2022, 3,414 of them in 2025 alone, and roughly $7 billion in settlements. The categories are wiretapping, data breaches, web tracking and unauthorised data sharing. Privacy litigation is no longer a minor risk, she said. It has become a major source of legal and financial exposure.

The instruments are old. The Video Privacy Protection Act was passed in 1988 to stop video rental records being disclosed and carries damages of $2,500 per violation; it is now the statute of choice against third-party tracking pixels on pages that play video. The California Invasion of Privacy Act dates from 1967 and was written about wiretapping; it now underpins claims about session recording and web tracking scripts. Plaintiffs, Fazlioglu said, are increasingly relying on older statutes in creative ways, particularly around web tracking and video viewing. Harm, she added, is one of the trickiest parts of privacy law, because it is so hard to conceptualise, which is part of why per-violation statutory damages are so attractive to plaintiffs: they remove the need to prove it.

The exposure runs through the vendor chain. Responsibility extends to what third parties a company works with are doing, and consent obtained by a third party on a company's behalf does not discharge the obligation. Vague, generalised disclosures are not enough; distinct consent mechanisms, two-year renewal periods and clear opt-outs are the standard being applied. Court decisions, on this reading, have become a source of privacy law in their own right, independent of what any legislature passes.

Put the two jurisdictions side by side and the division of labour is visible. European enforcement targets collection and retention inside platforms, which is what the DPC decision does. American enforcement has concentrated on the sale and onward flow of data: the Federal Trade Commission closed its case against Kochava on May 4, 2026, barring the broker from selling precise location data tied to sensitive locations without explicit consent, and Virginia's governor signed SB 338 on April 13, 2026, banning sales of precise geolocation within a 1,750-foot radius from July 1, 2026. Google's own American location record illustrates the difference in tempo: a San Francisco jury awarded $425.7 million in Rodriguez v. Google on September 3, 2025 over collection through the Firebase SDK after users had disabled Web and App Activity; Texas finalised a $1.375 billion settlement on October 31, 2025; a 40-state coalition recovered $391 million; a separate case settled for $62 million in May 2024. Dublin took six years and seven months from opening its inquiry to reach €403 million.

The commercial response to all of this is not abstention. It is relocation. Two announcements on September 21 describe the same manoeuvre from different ends of the supply chain: move audience construction to the sell side, where publishers hold logged-in relationships and documented consent, and away from the buy side, where identifiers have to be bought and matched.

Permutive announced an integration with TransUnion's identity graph covering 250 million consumers and 125 million households, applied across the 150-plus publishers on its platform, among them Hearst, Condé Nast, the BBC and Axel Springer. Joe Root, the company's co-founder and chief executive, put the underlying problem at roughly 30 percent: only about 30 percent of web traffic is addressable through a third-party cookie or an alternative identifier. Publishers have complete visibility of their logged-in users, he said, but cannot match those logins to other email addresses or build lookalikes from them, which caps the scale they can sell. Julie Clark, senior vice president for diversified markets, media and entertainment at TransUnion, described the point of the arrangement as having one key to many different sources and being able to scale that across publishers.

The economics are where the argument lives. Jim Williams, president of the independent agency KWG, said that applying data graphs on the buy side means data fees pile up, and that the sell-side version delivers more high-performing inventory with better match rates and lower data fees. His agency, he said, needs as much working media as possible and needs to avoid digital taxes whenever possible. A test campaign for a financial services advertiser produced a twelvefold increase in addressable impressions, reached five times more consumers and exceeded its key performance indicator by 170 percent. Permutive data from late August puts the penalty for going without at 41 percent: bid requests carrying no identity signal clear at CPMs that much lower.

The German version of the same move arrived with an automation layer attached. BCN, the sales house formed on January 1, 2024 from Hubert Burda Media's advertising sales alongside partnerships with FUNKE Mediengruppe and Mediengruppe KLAMBT, and PubMatic announced a system that turns a written brief into a private marketplace deal. The pool underneath is more than 80 million consented profiles drawn from over 50 premium German domains, expressed as more than 1,500 signals: over 900 people-based segments and more than 600 contextual categories. Contextual accounts for roughly 40 percent of the total and requires no identifier at all. BCN states that more than half of the signals rest on deterministic identifiers, meaning logins and verified emails rather than inference.

An advertiser writes something like a request to reach people with a high income who are currently interested in electromobility and in buying a premium vehicle. BCN's Signals Agent matches that against the signal library and, communicating with PubMatic's agents over the Model Context Protocol and the Ad Context Protocol, produces a pre-targeted private marketplace deal on PubMatic's platform within minutes. Carsten Sander, managing director at BCN, described the process as reducing an otherwise laborious workflow to a single question about which target group to reach. Emma Newman, PubMatic's chief revenue officer for EMEA, said the partnership shows how open standards in programmatic advertising unlock real economic benefits. The announcement was timed for DMEXCO in Cologne on September 23 and 24.

What neither party disclosed is substantial: which demand-side platforms can reach the deals, how prices are set and whether they are floors, data fees or fixed rates, how deal identifiers reach buying platforms, how revenue divides between the three parties, which identifiers count as deterministic, and whether other agents speaking the same protocol can query the Signals Agent at all. Selected signals are said to be checked against policies and brand safety requirements before activation, with every step documented, though whose policies apply is unstated. Nor is the consent documentation for 80 million profiles described in any detail, which is the part that the Dublin decision and the Council draft both bear on directly. PubMatic has been assembling this apparatus through 2026: AgenticOS launched on January 5, Optable's audience agent was embedded on March 12, a five-step governance framework arrived on August 5, and the second-quarter report of August 6 counted more than 80 fully autonomous campaigns and over 4,000 AI-powered deals cumulatively. DataBeat's June analysis of May data found agentic demand appearing in 86 percent fewer auctions than conventional buyers and clearing at $6.13 against $6.95. Magnite chief executive Michael Barrett observed on July 16 that activity remains one-to-one, a single buyer working with a single seller, rather than one-to-many.

The structural consequence is the one worth noting. Pre-targeted private marketplace deals concentrate spending outside open auctions, and putting the targeting logic on the sell side means the party that defines the audience is also the party that sets the price and holds the consent record. That is a different bargaining position from the one the buy side has occupied for fifteen years.

Google adds an allowlist to Analytics

The smallest item of the cycle is the neatest illustration. On September 21, Google Analytics gained an Include mode for hostname data filters, 102 days after the exclude-only version launched on June 11 alongside the Source Group dimension. The exclude version required an administrator to block each spam domain by hand, one at a time, forever. The include version is an inclusion list: approved domains authorised to send event data, with everything from unlisted hostnames discarded on arrival.

Two exceptions are documented. Hostname include filters are not applied to events sent through the Measurement Protocol, so server-side traffic remains unblocked regardless of the list. And include filters automatically block events with empty hostnames, including gtag.js traffic missing the value, on the reasoning that a missing hostname typically indicates spam.

The constraints are the familiar ones and they are unforgiving. Ten filters maximum per property, Editor role required at property level, no retroactive application to historical data, and no recovery of what is excluded. A misconfigured allowlist does not degrade gracefully; it deletes. The release documentation does not say whether matching is exact, wildcard or regular expression, how subdomains are treated, what happens to Data Manager API events, how app data streams interact, or whether multiple include filters can run at once.

The symmetry is hard to miss. In Dublin a regulator spent six years and seven months establishing that a company took data it should not have kept. In Brussels a Council working party is drafting the conditions under which the next round of collection will be lawful by default. In San Francisco and Los Angeles, plaintiffs are building a parallel liability regime out of statutes written for video shops and telephone lines. And in a product release note, a site owner is handed a list of domains permitted to send data in. Four decisions about who is allowed to collect what, made in four places, on four timetables, none of them synchronised with the others. The €403 million is the cost of the gap between them.

Also noted

  • September 22 - Comscore's second-quarter AI Intelligence data, drawn from an opt-in panel of between 500,000 and one million users, shows ChatGPT's share of prompt volume falling from 70 percent to 50 percent between January and June 2026 while Gemini nearly doubled from 17 to 30 percent and Claude rose from 2 to 11 percent, with desktop searches carrying AI Overviews up from 25.8 percent in July 2025 to 39.4 percent in June 2026. Digiday
  • September 21 - Amazon will require $1 million in commercial liability cover from every seller listing in eleven enhanced safety categories from November 2, 2026 regardless of sales volume, removing the previous $10,000 monthly gross proceeds threshold, and will reject new policies from Mainland China sellers unless obtained through its Insurance Accelerator programme. PPC Land
  • September 21 - X's published For You ranking configuration assigns copy-link shares a weight of 20.0 against 0.5 for likes, 5.0 for replies, quotes and direct message shares, 1.0 for reposts and minus 234.0 for reports, with the file noting that weights multiply predicted probabilities rather than raw engagement counts and partly reflect how rarely each action occurs. PPC Land
  • September 21 - Seven.One Entertainment opened Joyn pause advertisements to programmatic guaranteed buying through The Trade Desk, a pool of about 20 million monthly impressions across a service reaching more than 12 million unique users, with the format appearing full-screen four seconds after a viewer pauses and no competing units alongside it. PPC Land
  • September 21 - JustWatch, the streaming guide used by more than 50 million people monthly across 140 markets, will launch its own ad-supported, transactional and subscription service in twelve countries in October with Paramount, New Regency, Fremantle, Bleecker Street and Vortex Media as initial suppliers, turning a neutral index into a seller of inventory adjacent to its own audience data. PPC Land