Ireland fines Google €403 million over GDPR location tracking violations

Dublin regulator issues regulatory penalty

The Data Protection Commission of Ireland announced on 21 September 2026 that it has fined Google 403 million euros (approximately 345 million pounds or 462 million dollars) for breaching the General Data Protection Regulation. The penalty is the fourth largest ever issued by the Irish watchdog and concludes an inquiry initiated six years earlier in February 2020. European consumer rights organisations originally triggered the probe by submitting formal complaints regarding user tracking mechanisms. Because Google maintains its European headquarters in Dublin, the Irish regulator serves as the lead supervisory body for the tech firm across the European Economic Area. The ruling orders Google to bring its data processing operations into full compliance with EU standards within six months.

Scope of location tracking violations

The investigation assessed Google's location data processing from 25 May 2018, when the GDPR took effect, through 4 February 2020. Regulators examined three distinct software systems: Web and App Activity, which tracks browsing and search behavior; Location History, which records physical locations visited via mobile devices; and Location Accuracy on Android. The Commission determined that Google failed to meet legal requirements regarding the lawfulness and fairness of data processing in both Web and App Activity and Location History. The authority also cited Google for breaching accountability principles in Location Accuracy and violating transparency mandates across all three evaluated features.

Impact on user consent and retention

The inquiry established that Google stored user location data for durations exceeding what was strictly necessary for service delivery. Regulators stated that unconstrained location tracking compromises personal privacy because precise coordinates reveal daily routines, private associations, and personal habits. The Commission found that Google's interface and disclosures left users unaware that location tracking informed behavioral profiles used to personalize advertisements or infer user interests. Deputy Commissioner Graham Doyle addressed the obligations imposed by European privacy frameworks.

“The GDPR (General Data Protection Regulation) provides a high level of protection of personal data throughout the EEA (European Economic Area), and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.”

Doyle emphasized that while location data can enhance the utility of online services, it also carries the potential to cause significant harm when inherently private information is exposed. The watchdog concluded that the prolonged retention of user records aggravated this loss of individual control over personal data.

Product updates and corporate defense

Google defended its compliance record by stating that the regulatory decision focuses on historical operating procedures that have since been replaced.

“This case is about past policies that have since been updated. Since 2019, we have significantly improved our procedures and introduced effective tools that simplify the management of location data.”

The company pointed to technical modifications introduced after the investigated period, including automated deletion settings that allow users to wipe location records every 3, 18, or 36 months. Google now saves timeline records directly to individual mobile devices rather than central servers, and provides options to turn off personalized advertising completely. The company also modified its systems to record approximate coordinates rather than exact positioning and consolidated account privacy controls into a centralized management hub.