Google fined €403 million in Ireland over historical location-data practices

Ireland’s Data Protection Commission announced on September 21 a €403 million fine against Google over historical location-data practices and ordered the company to bring its processing into compliance within six months. The decision concerns data collected between 2018 and 2020 through Web & App Activity, Location History and location-accuracy settings.

What the Irish decision covers

The regulator’s finding is a regulatory decision, not an independent technical benchmark. It identifies failings involving lawfulness, fairness, transparency and retention under privacy rules applied to location data. In practical terms, the case is about whether Google’s handling of location information met the required standards for explaining, justifying and limiting that processing during the period examined.

The scope matters because the decision is not presented as a finding on every current Google product or every form of location use. It is tied to specific settings and a defined historical window. Web & App Activity, Location History and location-accuracy settings are distinct controls, but they can all relate to how a service records or uses signals about where a person is or has been.

The regulator’s concern also rests on the sensitivity of precise location. Precise location can reveal private information, including patterns that may point to interests, routines or sensitive places. It can also be used to infer interests or influence advertising. That does not mean every location signal has the same sensitivity, but it explains why retention, transparency and legal basis are central issues in this case.

What Google says changed

Google says the decision concerns historical practices that have changed since 2019. The company points to auto-delete options, on-device Maps Timeline storage and greater use of approximate areas. Those are company statements about product and policy changes, and they should be distinguished from the regulator’s finding on the earlier period.

Auto-delete options, as described by Google, address retention by allowing location-related information to be removed after a defined period rather than kept indefinitely. The relevance to the Irish decision is clear: retention was one of the areas where the regulator found failings. However, the existence of an auto-delete option does not by itself prove that the earlier processing was lawful, fair or transparent.

On-device Maps Timeline storage changes where certain location-history information is held. Keeping Timeline data on a device can reduce the amount of location history stored in central systems, depending on how a service is configured. The regulator’s decision, however, concerns the practices between 2018 and 2020, not an independent audit of how every current implementation operates.

Google also refers to greater use of approximate areas. The distinction between precise and approximate location is important because precise location can support more specific inferences about a person’s life. Approximate areas may reduce granularity, but the practical privacy effect depends on context, purpose and retention. The decision does not become a technical scorecard comparing old and new systems.

What the numbers show, and what they do not

The €403 million figure shows the scale of the administrative penalty imposed by Ireland’s Data Protection Commission. It is reported as the fourth-largest fine imposed by the Irish regulator. That ranking is a measure of enforcement severity within the regulator’s record; it is not a measurement of how many users were affected, how much data was collected or how profitable any processing may have been.

The six-month compliance order is separate from the monetary penalty. It gives Google a deadline to bring the relevant processing into line with the regulator’s requirements. The order is operationally significant because it moves the case beyond a financial sanction and into required changes or confirmations of compliance.

The comparison with the United States adds context but not equivalence. In 2022, Google reached a $391.5 million location-tracking settlement with forty US states. That settlement and the Irish fine both concern location-related practices, but they come from different legal systems and processes. One should not be treated as a direct benchmark for the other.

Nor do the figures prove the present state of Google’s systems. The Irish decision assesses historical practices from 2018 to 2020, while Google says it has changed practices since 2019. The fine demonstrates that the regulator found past failings serious enough to warrant a large penalty and a compliance order. It does not, on its own, establish an independent technical measurement of current location controls.

Practical implications

For Google, the immediate implication is regulatory: the company faces a €403 million fine and a six-month requirement to comply. The practical task is to align the relevant location-data processing with expectations around lawfulness, fairness, transparency and retention. Because the decision concerns several settings, compliance is not only a matter of one label or one switch.

For users, the case underlines why location settings can be difficult to evaluate. Web & App Activity, Location History and location-accuracy settings may sound separate, yet each can contribute to a picture of movement, place or proximity. The decision reinforces that clear explanations and retention limits are not secondary details; they are central to how people understand what is happening to their data.

For advertisers and data-driven services, the decision is another reminder that inferred interests based on location attract regulatory scrutiny. The issue is not only whether location can improve relevance. It is whether collection, use and storage meet privacy-law requirements, especially when precise location can reveal private information.

The broader significance is that historical product design remains exposed to later enforcement. Google’s position is that the relevant practices have changed, while the regulator’s decision imposes a penalty for the earlier period and a forward-looking compliance deadline. The outcome therefore sits at the intersection of past data practices, current controls and the continuing regulatory focus on location as a sensitive signal.