What Changed
- The DPC fined Google 403 000 000 EUR and ordered compliance within 6 months following an own-volition inquiry launched in February 2020.
- The inquiry found GDPR infringements regarding lawfulness, fairness, transparency, accountability, and data retention in 'Web & App Activity', 'Location History', and 'Location Accuracy'.
- The violations spanned location data processing conducted between 25 May 2018 and 4 February 2020.
Technology companies operating across borders and handling user location data face heightened regulatory compliance expectations following a significant enforcement action in the European Union. On 21 September 2026, the Irish Data Protection Commission (DPC), acting as the Lead Supervisory Authority for Google Ireland Limited (Google), issued a final decision imposing an administrative fine of 403 000 000 EUR alongside an order requiring Google to bring its data processing operations into compliance within six months.
The DPC initiated this own-volition inquiry in February 2020 following complaints from several European consumer rights organisations, including BEUC. The investigation focused on Google’s processing of location data across three specific features: “Web & App Activity”, “Location History”, and “Location Accuracy”. The scope examined activities occurring between the date of GDPR application on 25 May 2018 and 4 February 2020.
The decision by the Commissioners for Data Protection established that Google infringed multiple core requirements of the GDPR:
- Lawfulness and Fairness (Articles 5 and 6): Google failed to ensure the lawfulness and fairness of processing location data within Web & App Activity and Location History.
- Transparency (Articles 12 and 13): Google failed to meet its transparency obligations across all three features examined (“Web & App Activity”, “Location History”, and “Location Accuracy”).
- Accountability (Article 5): Google failed to demonstrate compliance with the principles of lawfulness, fairness, and transparency regarding personal data processing in Location Accuracy.
- Retention: Google infringed GDPR rules concerning the retention of location data in Web & App Activity and Location History.
This ruling directly impacts Google Ireland Limited and establishes significant enforcement criteria for tech companies processing location and tracking data across the EU. Organizations headquartered in Switzerland, mainland China, or other non-EU jurisdictions that offer digital products or services to individuals in the European Union must evaluate their consent mechanisms, transparency notices, and retention practices for location-based features.
Who May Be Affected
Google Ireland Limited, digital platform operators processing user location data, and EU data subjects.
Cross-Border Context
Applies to multinational digital service providers processing personal location data of individuals located in the European Union under GDPR requirements.
What to check next
- Official publication of the complete final decision text by the Irish Data Protection Commission (DPC)
- Any potential appeals filed by Google Ireland Limited in response to the administrative fine or compliance order
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.