Ireland's Data Protection Commission has fined Google 403 million euros, about $463 million, for the way the company collected and kept location data from European users. The decision, announced on Monday, closes an inquiry that the regulator opened in February 2020 and that looked at how three Google settings worked during the first two years of the GDPR.
Alongside the fines, the commission ordered Google to bring its processing into line with the law within six months. The full text of the decision has not been published yet, so the way the penalty is divided up and the detailed reasoning are not public. What the regulator has released so far is a summary of its findings.
The three settings under review
The inquiry covered the period from May 25, 2018, the day the GDPR began to apply, to February 4, 2020. It examined:
- Web & App Activity. An account setting that lets Google record what a signed in user does across its services. That record can include searches, browsing and location.
- Location History. An optional service that follows a phone wherever it goes, works out the places visited and the routes between them, and shows the result to the user on a private map called Timeline. It keeps recording even when no Google app is open.
- Location Accuracy. A feature of Android that combines other signals with GPS to fix a device's position more precisely. It works whether or not the owner has a Google account.
What the regulator found
The commission concluded that the way Web & App Activity and Location History used people's whereabouts was not lawful and fair in the sense the GDPR requires, and that the company held on to those records for longer than it needed to. For Location Accuracy the finding is one of accountability: Google could not show that what it did met the standard. On all three, the regulator found that Google had not been open enough with users about what was happening.
Explaining why this matters, the commission said people may not have realized that their movements were feeding advertising or being used to work out their interests, and so lost control over their own information. Keeping the records too long made that worse.
A complaint from 2018
The case began with consumer organizations. Several of them, coordinated by the European umbrella group BEUC, filed complaints arguing that Google steered people into switching location tracking on without making clear what they were agreeing to. Because Google's European headquarters is in Dublin, the Irish commission is its lead regulator under the GDPR, and it opened the inquiry on its own initiative after receiving them.
That was more than six years ago, and the settings have changed a good deal since. Google added controls in 2019 that delete activity and location records automatically after a set time, and it has since moved Timeline data off its servers and onto the user's own device. None of that is addressed in the summary released on Monday, which deals only with the period up to early 2020. The order to comply within six months suggests the regulator still sees something to fix, but until the decision itself is published it is not clear what.
Google has paid for the same settings before. In 2022 it agreed to pay $391.5 million to 40 US states that had accused it of misleading users about when location tracking was switched off.
