Google fined €403 million by Irish Data Protection Commission for GDPR violations

Google has been fined €403 million (£345 million) by the Republic of Ireland's Data Protection Commission (DPC) for its handling of location data. This penalty is one of the largest imposed by the Irish watchdog and follows an inquiry that began six years ago after complaints from several European consumer rights organizations. On September 21, 2026, the DPC stated that its investigation found Google processed data in a manner that was not 'lawful,' 'fair,' or 'transparent.' The inquiry focused on Google's processing of location data in three specific features: Web & App Activity, Location History, and Location Accuracy, between May 25, 2018, and February 4, 2020. Location data can reveal significant private information about individuals, according to DPC deputy commissioner Graham Doyle. The report indicated that Google's practices infringed the General Data Protection Regulation (GDPR), which came into effect on May 25, 2018, establishing strict data privacy and security laws within the European Union (EU). Doyle emphasized that the GDPR mandates that personal data processing must be lawful, fair, and transparent. He noted that due to Google's failures, individuals may have been unaware that their location data was being used for targeted advertising or to infer their interests, resulting in a loss of control over their personal data. The retention of users' location data for longer than necessary exacerbated this loss of control. In addition to the fine, Google has been ordered to bring its data processing into compliance within six months. In response, Google stated that the case pertains to historical policies that have since been updated, and they have made significant improvements in their data protection practices since 2019, including the introduction of auto-delete controls for user data.