Google Ireland has six months to bring three of its location features into line with European data protection law after Ireland's Data Protection Commission today imposed administrative penalties totalling €403 million, closing an inquiry it opened in February 2020 on the back of complaints from European consumer groups.

In Short

Ireland's privacy regulator decided today that Google broke Europe's privacy rules in the way three features on Android phones and Google accounts handled people's location between May 2018 and February 2020. The regulator said people may not have realised their location was being used to show them ads or to guess their interests, and that some of that information was kept longer than necessary. Google has been told to pay €403 million and to change how the features work within six months, although earlier Irish decisions of this kind have ended up in court.

Four findings, three features

The decision was taken by the three Commissioners for Data Protection, Des Hogan, Dale Sunderland and Niamh Sweeney, according to the DPC. It is addressed to Google Ireland Limited, the entity for which the Dublin authority acts as lead supervisory authority, and it concludes that Google infringed the GDPR on four counts. The inquiry examined processing in three products - Web & App Activity, Location History and Location Accuracy - across a fixed window running from 25 May 2018, the date the regulation became applicable, to 4 February 2020. That is 620 days of conduct, assessed more than six and a half years after the window closed.

The counts are not spread evenly. Web & App Activity and Location History were each found to have breached the principles of lawfulness and fairness in the processing of location data, Google's transparency obligations and the rules on retention. Location Accuracy shares only one of those findings: transparency. On lawfulness, the authority reached a narrower conclusion for the Android feature, holding that Google breached its accountability obligations because it was unable to demonstrate compliance with the lawfulness, fairness and transparency principle. No retention finding was made against Location Accuracy.

The distinction is more than drafting. Accountability puts the burden of proof on the company, and a failure to show that processing met the standard is not, on the DPC's wording, the same thing as a positive finding that the processing was unlawful. How much weight the full decision places on that line cannot yet be tested. The DPC says it will issue the text "in due course", and today's statement neither cites individual GDPR articles nor divides the €403 million among the four infringements.

Deputy Commissioner Graham Doyle framed the case around what location discloses about a person. "Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private," he said, according to the DPC.

Web & App Activity

Web & App Activity is a Google account setting available only to account holders, according to the DPC. When it is enabled, Google uses it to process information about users' activity on Google services, including sites and apps, and that information can include browsing history, search history and location data. The setting sits underneath consumer surfaces that matter to publishers. Discover, Google's personalised content feed, needs it switched on before the feed will personalise.

The setting has already been examined by a jury. On 3 September 2025 a federal jury in San Francisco ordered Google to pay $425.7 million in Rodriguez v. Google, a class action filed on 14 July 2020, after plaintiffs argued that switching Web & App Activity off did not stop Google gathering data through the Firebase software development kit embedded in third-party apps. That case turned on American privacy law and a separate data flow. The Irish decision goes to how the setting itself handled, explained and retained location data.

Location History

Location History, in the DPC's description, keeps track of users' location while they carry compatible mobile devices. It is opt-in. Once switched on, it processes each user's data to infer place visits, activities and the paths between those visits, and it powers a Timeline feature that displays a private map through Google Maps so that users can see where they have travelled. According to the DPC, Location History saves that map of where a user goes with signed-in devices even when the user is not using a Google service.

The product carries a litigation record in the United States. Google settled a case for $62 million in May 2024 over allegations that it tracked users' locations after they had turned Location History off. Texas pursued its own claims. Its attorney general finalised a $1.375 billion settlement on 31 October 2025, resolving allegations that included telling users that disabling Location History would stop the storage of places they visited while other settings kept tracking them. A separate coalition of 40 states had recovered $391 million for similar violations.

Location Accuracy

The third feature differs in kind. Location Accuracy is not an account setting but part of the Android operating system, allowing a device to determine its position more precisely than it could by relying on inputs from its GPS unit alone. The DPC notes that it is available to Android users regardless of whether they hold a Google Account, which extends the finding beyond the account-holder population covered by the other two features.

Which additional signals the feature draws on is not stated. The common technique for improving on a satellite fix is Wi-Fi positioning, in which a handset records the hardware address of each nearby access point, its BSSID, and a server matches those addresses against a table of known coordinates. Google's positioning service performs the calculation on its servers and returns only a position. Android has restricted access to Wi-Fi scan results over successive versions: version 8.0 made them conditional on location permission, version 9 throttled scanning, and version 10 added a requirement that location services be switched on.

Six years from complaint to decision

The inquiry was an own-volition investigation, opened in February 2020 by the DPC acting as Google's lead supervisory authority after it received complaints from several European consumer rights organisations, including BEUC. The statement names no other complainant and gives no date for the complaints. BEUC is the Brussels umbrella body for 42 consumer organisations from 31 countries.

From opening to decision, the process took about six years and seven months. The own-volition label is not a formality. When Meta challenged a DPC draft decision over access to its internal Hive data warehouse, it argued that Irish and European law separate complaint-based inquiries, whose scope is defined by the complaint, from own-volition inquiries, in which systemic issues may properly be examined. Ireland's High Court dismissed all of Meta's grounds on 21 May 2026, leaving a proposed fine of between €360 million and €430 million on course.

The panel itself is newer than the case. Sweeney became the commission's third commissioner, with a five-year term starting on 13 October 2025, after eight years in public policy roles at Meta; privacy group noyb questioned the appointment when it was made. The DPC's decision against LinkedIn in October 2024 was issued by Hogan and Sunderland alone.

The DPC thanked its peer supervisory authorities for their cooperation and assistance in the case. It did not say whether any of them objected to its draft under the GDPR's cooperation procedure. In the LinkedIn decision, the draft went through that mechanism in July 2024 and drew no objections from other EU and EEA authorities.

What Google says

The DPC's statement carries no response from the company. A Google spokesperson said the case centres on historical policies that have since been updated, according to the Irish Examiner. According to Yahoo Finance, the company added that it had substantially changed its practices from 2019 onwards, pointing to settings that let users automatically delete account data on a rolling three-, 18- or 36-month basis, controls to switch off personalised ads entirely or manage how location data is used for advertising, and the storage of Timeline data directly on users' devices.

That account and the DPC's findings do not sit neatly together. The changes Google cites began in 2019, yet the inquiry's scope ran until February 2020, so part of the examined period overlaps with the updates the company describes. And while the findings look backwards, the order looks forwards: the DPC has told Google to bring "its processing into compliance within 6 months". Today's statement does not say whether the authority assessed the current versions of the three features, nor what compliance would require of products Google says it has already rebuilt. The full decision is the document most likely to settle both points.

Where the penalty ranks

The €403 million is equivalent to about $463 million, according to Reuters, and it is the fourth-largest penalty the DPC has issued since the GDPR took effect, according to TNW. TikTok was fined €530 million by the same authority on 30 April 2025, €485 million of it for transfers to China and €45 million for transparency failures. LinkedIn's penalty in October 2024 was €310 million.

Other European authorities have reached comparable figures in the same period. France's CNIL fined Google €325 million on 1 September 2025 over Gmail advertising and cookie consent during account creation, splitting the penalty between Google LLC, at €200 million, and Google Ireland Limited, at €125 million. On 21 August 2026 the Dutch authority fined Uber €824,990,000 over fully automated decision-making, a decision the company has appealed.

Headline totals and money collected are different measures, however. An Alliance Risk analysis published in May 2026 found that nearly 40% of the €7.1 billion in GDPR fines issued since 2018 had been annulled or were under active challenge, with Ireland accounting for 66% of all fine value. The largest single penalty, the €1.2 billion the DPC imposed on Meta in May 2023 following a binding decision of the European Data Protection Board, is among those still on appeal. In September 2025 noyb put the share of Irish fines against major companies that had actually been collected at only 0.6%.

Six months, and a precedent

Six months is the same period the DPC gave TikTok, which was ordered to bring its transfers to China into compliance within that window or have them suspended. TikTok appealed, and Ireland's High Court granted a conditional stay in November 2025, so the suspension order is not being enforced while the case proceeds. Google has not said publicly whether it will challenge today's decision. If the six months run from today, the period would end on 21 March 2027, though the statement does not specify the starting point.

Today also carries a separate European deadline for the company. On 23 July 2026 the European Commission fined Google €890 million under the Digital Markets Act and gave it 60 days to comply, a deadline that falls on 21 September 2026. Google has already removed free shopping listings from search results across the European Economic Area under that regime. The two cases rest on different laws and sit with different authorities, competition-style obligations in Brussels and data protection in Dublin, yet they arrive on the same day.

Why it matters for advertising

The DPC's reasoning names advertising directly. "As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," Doyle said, according to the DPC. Inferred interests feed audience targeting, while location is a primary input to local and offline measurement.

The measurement link runs through Location History. Google's store visits conversions, its own implementation of footfall attribution, are modelled from signed-in users with location history enabled who interact with an advert and later visit a business, with Google extrapolating from those observed cases to the wider exposed population. The measurement is offered in 36 countries. Google's consumer product has since moved the other way: Maps Timeline, first detailed in December 2023 and rolled out through 2024, shifted history storage onto devices and cut default retention from 18 months to three. Google's advertising documentation still describes an account-level location history opt-in, and the company has not publicly reconciled the two. Today's statement does not mention store visits, or any advertising product, by name.

Retention may prove the finding with the widest reach. Rules on how long personal data may be kept rest on storage limitation, a principle that sits beside data minimisation in the GDPR rather than inside it, and Doyle singled it out: "The retention of users' location data for longer than necessary aggravated this loss of control". Google has separately been narrowing data windows in its advertising products. Granular Google Ads reporting data was limited to 37 months from June 2026, and Customer Match list membership has been capped at 540 days since April 2025.

European and American enforcement are also aiming at different points in the chain. In the United States the pressure has concentrated on the sale of location data. The Federal Trade Commission closed its Kochava case with a stipulated order signed on 4 May 2026, barring the data broker from selling precise location data linked to sensitive locations without explicit consent, and Virginia's governor signed SB 338 on 13 April 2026, banning the sale of precise geolocation datawithin a 1,750-foot radius from 1 July 2026. The Irish decision concerns something else: a platform's own collection, explanation and storage of location inside products its users switch on themselves.

What the six months will change in practice depends on a text that has not yet been published. Will the settings European users see in March 2027 look any different - or will the order, like TikTok's, be waiting on a judge?

Timeline

Summary

Who: Ireland's Data Protection Commission, acting through Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney, against Google Ireland Limited, with Deputy Commissioner Graham Doyle speaking for the authority. The inquiry followed complaints from European consumer organisations including BEUC. The affected population includes Google account holders in the EEA and, for Location Accuracy, Android users with or without a Google Account.

What: A final decision finding that Google infringed the GDPR on lawfulness and fairness in Web & App Activity and Location History, on accountability in Location Accuracy, on transparency across all three features, and on retention in Web & App Activity and Location History. The DPC imposed administrative fines totalling €403 million and ordered Google to bring its processing into compliance within six months. The full decision has not yet been published, and no breakdown of the penalty by infringement has been given.

When: The DPC set out the decision today, 21 September 2026. The inquiry opened in February 2020 and covered processing between 25 May 2018 and 4 February 2020.

Where: The decision was taken in Dublin by the lead supervisory authority for Google Ireland Limited and concerns processing of personal data across the European Economic Area.

Why: According to the DPC, Google's failures meant individuals could have been unaware that their location was used to influence them with ads or to infer their interests, and retention of location data beyond what was necessary aggravated the resulting loss of control. For advertisers and publishers, the settings in question feed consumer products such as Discover and advertising measurement such as store visits conversions, and the six-month order applies to those settings in Europe unless a court pauses it, as happened with TikTok's order.