Google Fined €403 Million Over EU Location Data Rules

Google has been ordered to pay a €403 million fine, described as $463 million, after Ireland’s Data Protection Commission found breaches of European Union privacy rules in the company’s handling of location data. The decision also gives Google six months to bring the relevant processing into compliance with the General Data Protection Regulation, or GDPR.

The case concerns historical practices examined from May 2018 through February 2020. That timeframe matters: Google says the policies at issue have subsequently changed, while the regulator’s decision focuses on whether the company’s collection and retention practices met GDPR requirements during the period investigated.

For players and other Android users, location data can feel less dramatic than a password or a payment card. It is nevertheless highly revealing. A record of places visited, routes travelled and recurring locations can build an unusually detailed picture of someone’s routines. The central issue in this case is not that location tools exist, but whether the legal basis, explanations and retention of that data met the EU’s required standard.

What the regulator examined

Ireland’s Data Protection Commission, commonly called the DPC, began its investigation in 2020 after complaints from consumer-rights groups. Ireland acts as Google’s principal EU regulator because the company’s European headquarters are in Dublin.

The inquiry considered three separate Google features. They overlap in everyday use, but they are not interchangeable:

Web & App Activity saves activity across a range of Google services. The DPC examined its handling of location data within that broader activity setting.
Location History is an opt-in setting that can create a timeline of where a user has been while carrying their phone.
Location Accuracy improves an Android device’s estimate of where it is, beyond GPS alone.

That distinction is useful because “location data” is not one single switch or one single type of record. A timeline of past places is different from a service’s activity record, and both are different from data used to calculate a device’s current position more precisely. Privacy controls and legal obligations can therefore depend on the feature and purpose involved.

The DPC found that Google did not process location data fairly or lawfully through Web & App Activity and Location History during the period assessed. It also found that Google had failed to demonstrate compliance with the GDPR’s principle of lawfulness, fairness and transparency for Location Accuracy.

Those terms carry specific weight under the GDPR. Lawfulness concerns whether there is an appropriate legal foundation for processing personal data. Fairness concerns whether the way data is handled is fair to the person whose information is involved. Transparency means people must receive clear, understandable information about what is being done with their data.

The regulator said Google failed to meet transparency obligations for all three features. In practical terms, the finding means the regulator did not consider the information and handling surrounding these settings sufficient under the regulation. The DPC also said Google breached data-retention rules for Web & App Activity and Location History.

Data retention refers to how long personal data is kept. The GDPR places limits on storing information longer than necessary for the purpose for which it was collected. A retention finding does not merely concern a setting being on or off; it concerns the duration for which the resulting information remains held.

Google says the policies were changed

Google has characterized the matter as relating to historical policies that have been updated. The company said it significantly changed its practices from 2019 onward and introduced tools intended to make location-data management simpler.

That response places an important boundary around what can be inferred from the decision. The ruling addresses conduct in the investigated 2018–2020 window; it does not, on its own, establish that every current Google location setting operates in exactly the same way as the versions reviewed by the DPC. At the same time, the order to make the processing compliant within six months shows that the regulator requires further compliance action under its decision.

For users, this is a reminder that a privacy dashboard is useful only if its choices and explanations are understandable. A setting labelled as activity, history or accuracy may affect different kinds of information. Anyone reviewing their own preferences should avoid assuming that adjusting one location-related option necessarily answers every location-related question across a device and its services.

Why this is relevant beyond map apps

Location tools have obvious uses: directions, local results and place-based services all depend on knowing something about where a device is. But the value of location information stretches beyond a navigation screen. It can be tied to activity across services, used to form a history, or used to improve a device’s positional estimate. That is why the DPC examined each of the three mechanisms individually rather than treating them as one generic location function.

For gamers, mobile devices frequently sit alongside gaming hardware and accounts, acting as a platform for companion services, logins, storefront browsing and communications. This ruling does not make any claim about a particular game or gaming service. Its broader relevance is more straightforward: the more services a person uses through a phone, the more important it is that data controls explain what they govern and that companies can justify how long sensitive information is retained.

It also sits within a wider conversation about consumer-facing digital terms. Privacy information, subscription conditions and service settings can be easy to overlook precisely because they are woven into products people use every day. For a separate example of how conditions can matter beyond a headline plan name, see our coverage of subscription fine print and ad-supported plan language.

The DPC said this is the fourth-largest fine it has issued since the GDPR took effect. It also noted that its largest fine to date was $1.3 billion against Meta over transfers of EU Facebook user data to servers in the United States.

The Google decision is separate from other EU cases involving the company. This summer, Google lost its final appeal concerning a $4.7 billion Android antitrust penalty originally imposed in 2018. The European Commission also imposed a $1 billion fine in July after finding that Google had unfairly favoured its own services in Search results. Google agreed this month to make certain Search changes intended to reduce that fine.

These matters involve different regulators and different legal questions. Antitrust cases concern competition and market conduct; the DPC’s latest decision is a privacy enforcement action under the GDPR. Combining them into one broad “Big Tech trouble” narrative would blur a key point: a company can face major EU scrutiny on multiple fronts, but each decision rests on its own rules, facts and remedy.

What happens next

Google must pay the €403 million penalty and has six months to make the location-data processing at issue compliant with GDPR requirements. The DPC also says it has three other statutory large-scale inquiries involving Google that are at an advanced stage.

The immediate practical takeaway is not that every location feature should be treated as inherently improper. The case instead underscores the GDPR’s demands around clarity, lawful processing and limits on holding personal information. When companies collect data capable of mapping a person’s movements, the wording around controls, the basis for processing and the lifespan of the records are all consequential parts of the product—not background details.