Ireland’s Data Protection Commission (DPC) has fined Google €403 million for breaches of European information privacy laws related to the tech giant’s processing of its users’ location history and data.
As a result of these infringements, Google users may have been “unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data”, said DPC deputy commissioner Graham Doyle in a statement.
It is understood that Google may appeal elements of the decision.
Under the EU’s General Data Protection Regulation (GDPR), the processing of such data must be lawful, fair and transparent.
READ MORE
The DPC said its investigation, which began in 2020 and covers the period from the introduction of GDPR in May 2018 to February 4th, 2020, found that Google infringed the GDPR by processing users’ location data unlawfully and unfairly through three features: web and app activity, location history and location accuracy.
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which, by itself or in conjunction with other information, an individual’s location can be inferred,” Doyle said.
Google has been given six months to address the issues. However, the tech giant said the case centres around “historical policies” that have since been updated.
“From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” a spokesperson for Google said.
The company now allows users to delete their data automatically once a certain period – between three and 36 months – has expired. Google also stores location data that populates the “Timeline” feature on Google Maps on users’ devices, and has simplified the management of how personal data is used for ad personalisation.
[ Google says its Gemini AI model hacked three other companiesOpens in new window ]
Location data is considered particularly sensitive because it can be used to reveal details about users’ personal lives, from religious beliefs and health conditions to political opinions.
The €403 million fine is the fourth largest that the DPC has handed down since the GDPR came into force. The largest remains Meta’s €1.2 billion fine imposed in 2023, with TikTok’s €530 million fine and a €405 million for Instagram completing the top three.
The decision was welcomed by the European Consumer Organisation, BEUC, which had co-ordinated the complaints to the DPC. A total of eight consumer organisations from Norway, the Netherlands, Greece, Czech Republic, Slovenia, Poland, Sweden and Denmark had filed complaints against, or reported, the way Google tracked users’ locations.
“The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data,” said Agustín Reyna, director general of BEUC. “However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement. Late enforcement can be as harmful as no enforcement at all. Consumers’ fundamental rights need to be upheld faster and better.”
The DPC has three other large-scale inquiries open that concern Google, all of which are at an advanced stage.
