Ireland fines Google €403 million over location data and GDPR violations

Irish regulator penalises location data practices

Ireland's Data Protection Commission (DPC), acting as the lead supervisory authority for the European Union, fined Google 403 million euros (462 million dollars) on 21 September 2026. The decision concludes an inquiry into how the Alphabet subsidiary processed and stored personal location records across its services. Investigators examined three distinct features: Web & App Activity, Location History, and Location Accuracy between 25 May 2018 and 4 February 2020. The authority established that Google breached General Data Protection Regulation (GDPR) requirements regarding lawful processing, fairness, transparency, and accountability. The DPC also issued an order requiring Google to bring its data processing operations into compliance within six months.

Consumer complaints and tracking mechanisms

The formal inquiry began in February 2020 after consumer protection organisations across seven European countries submitted coordinated complaints in November 2018. The filings drew upon research conducted by the Norwegian Consumer Council, which demonstrated how interface designs prompted users into enabling persistent location tracking without clear understanding. DPC commissioners Des Hogan, Dale Sunderland, and Niamh Sweeney found that Google retained location data longer than necessary and failed to provide transparent explanations about how geographical coordinates were used for targeted advertising and profile building.

As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests.

Corporate response and enforcement delays

Google stated that the sanction addresses discontinued operational frameworks that were superseded by newer privacy controls. The company pointed to automated deletion settings and management dashboards introduced across its products starting in 2019.

This case centers around historical policies that have since been updated. From 2019 onward, we've significantly evolved our practices and launched robust tools that make managing location data simple.

Consumer advocates supported the penalty but expressed concern over the multi-year administrative process required to reach a binding enforcement decision.

The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples' location data. However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement... Consumers' fundamental rights need to be upheld faster and better.

Scale of penalties and active investigations

The 403 million euro fine is the fourth-largest penalty issued by the Irish DPC since GDPR enforcement began in 2018. It stands behind a 1.2 billion euro fine imposed on Meta Platforms in 2023 for transatlantic data transfers, and a 530 million euro penalty issued against TikTok in May 2025 for transferring European user data to China. The Irish authority exercises European jurisdiction over Google because the technology firm maintains its regional headquarters in Dublin. The DPC is currently conducting three additional large-scale inquiries into Google, which examine data processing in the PaLM2 artificial intelligence model, the company's personalised advertising system, and the user account registration flow.