Google has been fined 403 million euros (approximately $463 million) for violating the European Union's strict privacy regulations, specifically concerning the mishandling of users' location data. The ruling came from Ireland's Data Protection Commission (DPC), the lead EU regulator for Google due to its European headquarters being based in Dublin.
The investigation, which commenced six years ago, found that Google did not lawfully or fairly process location data in users' Web & App Activity, a setting that tracks browsing and search history, nor in their Location History, which maps user movements. The DPC also determined that Google failed to be lawful, fair, and transparent when processing personal data in its Location Accuracy feature within the Android mobile operating system.
The General Data Protection Regulation (GDPR), the EU's comprehensive privacy rulebook, has been in effect since 2018. The investigation examined Google's compliance with these rules from their inception until February 2020.
"This case centers around historical policies that have since been updated," a Google statement read. "From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple."
Regulators emphasized the sensitivity of location data, noting it can be used to infer an individual's whereabouts and reveal private information. "Location data can bring both benefits and harms to individuals," stated Deputy Commissioner Graham Doyle. "It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private."
This fine represents the fourth largest privacy penalty issued by the Irish watchdog. Previously, larger fines were levied against TikTok and Meta, with Meta receiving a 1.2 billion euro penalty. The DPC indicated that three other privacy investigations involving Google remain ongoing.