Google has been penalised €403 million ($463 million) by the European Union’s privacy regulator for alleged violations involving the handling of users’ location information.
Ireland’s Data Protection Commission (DPC) said the company failed to process location data in a lawful, fair and transparent manner.
EU regulator flags Google location data practices
The investigation examined Google’s Web & App Activity and Location History services, which collect information related to users’ searches, browsing patterns and places visited through mobile devices.
The regulator also raised concerns over the company’s Location Accuracy feature in the Android operating system.
Ireland’s DPC acts as the lead privacy authority for Google in the European Union as the company’s regional headquarters is located in Dublin. The inquiry, which began six years ago, reviewed Google’s practices under the General Data Protection Regulation (GDPR) from 2018 until February 2020.
"This case centres around historical policies that have since been updated," Google said in a statement. "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."
The regulator said location information is sensitive personal data because it can provide insights into an individual’s movements and private activities.
Privacy concerns continue for big tech firms
Deputy Commissioner Graham Doyle said location data can offer useful services but also create risks for individuals.
"Location data can bring both benefits and harms to individuals," Doyle said. "It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private."
The fine is among the largest issued by Ireland’s privacy watchdog, ranking as its fourth biggest penalty. The regulator has previously imposed larger fines on companies including TikTok and Meta, including a €1.2 billion penalty against Meta.
The DPC said it continues to investigate three other privacy-related matters involving Google, indicating that regulatory scrutiny of the company’s data practices remains ongoing.
