Google has been fined €403M, or about $463M, by Ireland’s Data Protection Commission over the way it handled users’ location data, in a case brought after several European consumer groups complained.
It found breaches of lawfulness and fairness in the location data processed through Web & App Activity and Location History, of transparency across those and a third setting, Location Accuracy, of Google’s accountability obligations, and of the rules on how long data is kept.
The findings cover May 2018 to February 2020, and Google has six months to bring the processing into line.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests,” said Graham Doyle, the commission’s deputy commissioner.
The commission opened the inquiry on its own initiative in February 2020, as Google’s lead supervisory authority in the EU, after European consumer groups including BEUC complained.
Those complaints were filed in November 2018 by groups in seven countries, built on Norwegian Consumer Council research into how Google’s interface design steered people into leaving tracking on.
A Google spokesperson told the Irish Examiner the case concerns “historical policies that have since been updated”, pointing to auto-delete controls introduced from 2019.
It is the fourth largest penalty the regulator has issued since GDPR took effect, behind the €1.2bn imposed on Meta in 2023 for sending Europeans’ personal data to the United States.
Published
Back to top