Google has been fined 403 million euros (approximately $463 million) for breaching the European Union's privacy rules due to its mishandling of users' location data, the EU's data privacy watchdog announced Monday.
Ireland's Data Protection Commission (DPC) stated that its investigation concluded Google did not lawfully or fairly process location data within users' Web & App Activity and Location History settings. These settings track browsing and search history and map places visited via mobile phones, respectively.
Regulators also found that the company failed to act lawfully, fairly, and transparently when processing personal data for its Location Accuracy feature in the Android mobile operating system.
Ireland serves as the lead regulator for Google within the 27-nation European Union because the U.S. tech giant's European headquarters is located in Dublin. The investigation, which commenced six years ago, examined Google's application of the EU's General Data Protection Regulation (GDPR) from its implementation in 2018 through February 2020.
"This case centers around historical policies that have since been updated," Google said in a statement. "From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple."
Location data is considered personal data that, when collected by Google, can be used to infer an individual's whereabouts. "Location data can bring both benefits and harms to individuals," Deputy Commissioner Graham Doyle said. "It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private."
The fine is the fourth largest EU privacy penalty issued by the Irish watchdog. The DPC has previously imposed larger fines on TikTok and Meta, including a 1.2 billion euro penalty for Meta.
The regulator indicated that three other privacy investigations involving Google are currently ongoing.