Ireland's DPC Fines Google €403M Over Location Data

Ireland's Data Protection Commission fined Google €403 million on 21 September over unlawful, unfair and non-transparent location-data processing, and ordered compliance within six months — the DPC's fourth-largest GDPR fine.

The DPC's 21 September decision closed an own-volition inquiry opened in February 2020, after BEUC and other consumer groups complained about how Google processed location data through Web & App Activity, Location History and Location Accuracy. The Commission found infringements of the lawfulness, fairness, transparency, accountability and retention rules, imposed fines totalling €403 million, and ordered Google to bring its processing into compliance within six months (roughly 21 March 2027). Google is expected to appeal.

For compliance teams the message is direct: location and geolocation processing is squarely in the enforcement crosshairs. Lawful basis, transparency notices, retention schedules and — critically — the accountability records that prove compliance for location-derived inferences and ad targeting are all now fair game for a nine-figure penalty.

It lands in a busy week. The EDPB has just adopted a common five-step method for deciding when a GDPR fine should follow an infringement (open for consultation to 13 November), while enforcement momentum continues in the US, where California's privacy agency keeps fining unregistered data brokers, and in India, where the consent-manager registration clock runs to 13 November.