Irish regulator fines Google €403 million over location data

Irish regulator fines Google €403 million over location data

22 September 2026 — Ireland's Data Protection Commission (DPC) announced on 21 September 2026 that it has fined Google Ireland Limited €403 million and ordered it to bring its processing of location data into compliance with the GDPR within six months. The DPC acted as lead supervisory authority for Google. Its own-volition inquiry opened in February 2020, after complaints from several European consumer organisations, including BEUC.

What the DPC found

The inquiry covered three features between 25 May 2018, when the GDPR began to apply, and 4 February 2020:

• Web & App Activity, a Google Account setting that can record activity on Google services, including location data.
• Location History, an opt-in service that tracks where signed-in mobile devices go and shows it on a private Timeline map.
• Location Accuracy, an Android feature that improves location fixes beyond GPS and is available whether or not the user has a Google Account.

The decision, taken by Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney, found infringements of lawfulness and fairness (Web & App Activity and Location History), accountability (Google could not demonstrate compliance for Location Accuracy), transparency (all three features) and retention (location data kept too long in Web & App Activity and Location History). Deputy Commissioner Graham Doyle said people may not have known their location was being used to influence them through ads or to infer their interests.

The DPC says it will publish the full decision in due course. In a statement reported by RTÉ, Google said the case concerns historical policies and that it has changed its practices since 2019, adding automatic deletion settings and ad controls. RTÉ reported it is "understood" Google will appeal; The Irish Times reported it is understood Google may appeal elements of the decision. Both are unattributed; we have seen no confirmed statement from Google that it will appeal. The Irish Times says this is the fourth-largest fine the DPC has imposed under the GDPR.

What to do

• Android fleet admins: check how Location Accuracy and other location settings are configured on managed devices, and whether your device management policy restricts them where there is no business need.
• Google Workspace admins: review whether Web & App Activity and Location History are available to managed accounts. The DPC release does not mention Workspace, so ask Google directly whether its compliance changes will reach business accounts.
• Advertisers using location targeting or store-visit measurement: ask Google, and any other supplier, what lawful basis and retention periods apply to the location signals behind those products, and record the answers in your data protection impact assessment.
• Privacy teams: note the six-month compliance period and watch for the published decision, which should show exactly what Google must change.

What the announcement leaves out

The release does not split the €403 million by infringement, say when the six months started, or list the specific corrective orders. Those details should appear in the full decision.

Sources

• Data Protection Commission — Data Protection Commission fines Google €403 million following Inquiry into Google’s processing of location data — 21 September 2026
• RTÉ News — Google fined €403m by Irish watchdog over location data — 21 September 2026
• The Irish Times — Irish data protection watchdog fines Google €403m over GDPR breaches — 21 September 2026