Ireland’s privacy regulator has handed Google a GDPR fine of €403 million over the way it tracked and stored user locations. The Data Protection Commission (DPC) found that three everyday features broke Europe’s data protection rules. As a result, the tech giant now has six months to fix its practices. For Android and Google Account holders, the case raises an uncomfortable question about how much their phones revealed.
Why Irish Regulators Hit Google With a GDPR Fine
The investigation began in February 2020, after several consumer rights groups filed complaints about Google’s handling of location data. Investigators then studied how three features worked between May 25, 2018, and February 4, 2020. The GDPR took effect on the first of those dates, so the case covers the early years of the law.
The complaints centered on a simple concern about clarity. In short, users wanted to know what Google collected, why it collected it, and how long it kept it. The DPC decided that Google fell short on these points, so it chose to fine Google heavily under the GDPR.
The Three Google Features Under Scrutiny
Web & App Activity
Web & App Activity is a setting linked to Google Accounts. It lets Google process what users do across its services, including search history, browsing history, and location data. In practice, one setting can connect what a person searched for with where they stood at the time.
Location History
Location History is an opt-in service that follows compatible phones as their owners move around. It can work out the places a person visited, what they did there, and the routes they took. Google showed all of this in a private Google Maps Timeline, and the tracking continued even when no Google app was open.
Location Accuracy
Location Accuracy is an Android feature that helps a phone find its position more precisely than GPS alone. Unlike the other two features, it does not require a Google Account. That wide reach made it an important part of the case.
What the DPC Found
The DPC ruled that Google processed location data through Web & App Activity and Location History without meeting GDPR requirements. It also said the company could not prove it followed GDPR principles for Location Accuracy. On top of that, Google failed its transparency duties for all three features. It also kept some location data longer than it needed to.
These failures form the basis of the GDPR fine that Google now faces. Deputy Commissioner Graham Doyle explained that people may not have known Google used their location to target them with ads or guess their interests. He added that the long retention of this data made their loss of control even worse.
What Google Must Change After the GDPR Fine
In total, the GDPR fines against Google add up to €403 million, or roughly $463 million. Beyond the money, Google has six months to make its data processing comply with the GDPR. The DPC has not yet published its full decision, but it has promised to release it later.
Google, however, has pushed back on the GDPR fine. A company spokesperson said the case centers on historical policies that no longer apply. The spokesperson added that Google has changed its practices a great deal since 2019 and now offers simple tools to manage location data.
Google’s Changes Since 2019
Today, users can set automatic deletion schedules for the data in their accounts. Google Maps Timeline now keeps its records on the device itself and deletes anything older than three months. The company also says Web & App Activity no longer saves a precise device location and records only an estimated general area.
Why Location Data Matters for Your Privacy
Location data can reveal far more about a person than their search history or social media posts. A list of places visited can point to someone’s home, workplace, doctor, or place of worship. Advertisers value that information, and in the wrong hands it can also expose people to stalking or fraud.
European regulators clearly see this risk, and the size of the GDPR fine against Google sends a strong message to other tech firms. Any company that collects location data must explain its practices in plain terms and delete what it no longer needs. Otherwise, it could face the same kind of GDPR fine that Google received from the DPC.
How to Protect Your Location Data
Google users do not need to wait for another GDPR fine to take control of these settings. First, open the Data & Privacy section of your Google Account and review Web & App Activity and Location History. You can pause either setting, delete past records, or turn on auto-delete for old data. On Android, you can also find Location Accuracy in your location settings and switch it off.
Next, check which apps have permission to see your location. Many apps ask for access they do not need, so limit each one to “while using the app” or deny it entirely. These small steps cut down the personal data your phone shares every day.
A VPN adds another layer of protection, but it helps in a specific way. It hides your real IP address, which websites and advertisers use to estimate your city or region. However, a VPN cannot block GPS tracking or stop Google from logging activity inside your account. For that reason, it works best alongside careful privacy settings.
Final Thoughts
The €403 million GDPR fine against Google closes a case that began more than six years ago. Still, its lessons remain relevant, because companies must now explain how they use location data and delete it once it serves no purpose. Over the next six months, Google must show the DPC that its current practices meet the rules after this GDPR fine. For everyday users, the smartest move is to check their location settings now, before another investigation reveals what their devices have shared.
