Ireland’s Data Protection Commission has fined Google €403 million after concluding that the company’s practices for obtaining consent to process users’ location data violated the European Union’s General Data Protection Regulation.
The decision concerns how Google gathered permission to use location information, including data that could influence the advertising shown to users. The regulator found that people may not have understood that their movements were being used for that purpose. It ordered Google to bring the affected practices into compliance within six months.
Location information receives particular scrutiny because a person’s movements can expose highly private details. Regular visits to a medical facility, place of worship, political meeting or other sensitive location can reveal health conditions, religious beliefs or political views even when a user has not explicitly provided those details. That makes the quality and clarity of consent central to whether such processing is lawful.
Google said the case relates to historical policies that it has since changed. The company said that from 2019 onward it introduced stronger controls intended to make location-data management easier. Current tools include automatic deletion after a period chosen by the user, ranging from three to 36 months. Google also stores information used by the Maps Timeline feature on users’ devices and has simplified controls for advertising personalization.
The investigation followed action by consumer groups in eight European countries: Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland, Sweden and Denmark. The European Consumer Organisation, known as BEUC, coordinated the complaints and welcomed the finding that Google’s consent process had been unlawful. It also criticized the length of time required to reach a decision, arguing that delayed enforcement weakens protection for consumers.
At €403 million, the penalty is the fourth largest issued by the Irish watchdog since the GDPR took effect. Larger Irish decisions cited in the supplied report include a €1.2 billion fine against Meta, a €530 million fine involving TikTok and a €405 million Instagram penalty. The comparisons show the scale of the sanction, although each case concerns different conduct and legal findings.
Ireland’s regulator plays an important role in European technology enforcement because many large US technology companies base their regional headquarters there. The Google ruling also arrives while the commission has three other large-scale inquiries concerning the company at an advanced stage, according to the report.
The immediate consequences are the financial penalty and the compliance deadline. Whether Google contests the ruling, and precisely which additional changes the regulator will accept, are not established by the supplied evidence. The case nevertheless reinforces that privacy controls added after data collection begins do not automatically resolve questions about whether the original consent was informed and valid.
