EU Fines Google €403 Million Over Improper Handling of User Location Data

The European Union has taken significant regulatory action against tech giant Google, issuing a €403 million fine over the improper use of consumer location data. The announcement was made on Monday by Ireland's Data Protection Commission, which acts on behalf of the broader European Union on such matters.

According to the Irish regulator, the penalty stems from violations of the EU's General Data Protection Regulation that occurred between May 2018 and February 2020. The inquiry itself was formally opened in February 2020 after coordinated complaints were initially filed in November 2018 by consumer organizations across multiple European countries.

The complaints that sparked the investigation originated from consumer groups in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia, and Sweden. These groups were brought together by the European Consumer Organisation, known as BEUC, to challenge how the tech conglomerate handled sensitive user information.

In its final decision, the Data Protection Commission determined that Google had infringed GDPR rules concerning the lawfulness and fairness of processing location data within web and app activity, as well as location history. The DPC noted that this marks the fourth-largest fine ever imposed by the Irish regulatory body.

Graham Doyle, deputy commissioner at the DPC, explained the implications of the regulatory breach for everyday users. He stated that Google's failures meant individuals could easily have remained unaware that their personal location was being utilized to influence them with targeted advertisements or to infer their personal interests.

Doyle further noted that the problem was compounded by the company retaining users' location data for longer periods than was strictly necessary, which ultimately aggravated the loss of personal control over private information. Alongside the substantial monetary penalty, the regulator has formally ordered Google to bring its practices fully into compliance with GDPR within a six-month window.

Google responded to the ruling by emphasizing that the case focuses heavily on historical company policies that have already been revised. In an official statement, the technology corporation asserted that it has significantly evolved its practices starting from 2019 onward, introducing robust tools designed to make managing personal location data simple for users.

While consumer groups welcomed the ultimate accountability enforced by the decision, the protracted timeline drew sharp criticism. BEUC director general Agustin Reyna described the ruling as an important victory for consumers that confirms the illegality of how the tech giant previously obtained consent.

However, Reyna criticized the eight-year duration required to reach a definitive conclusion as disproportionate to the seriousness of the underlying infringement. He warned that late enforcement can often prove just as harmful as a complete lack of enforcement, stressing that fundamental consumer rights must be upheld much faster in the digital age.

BEUC also highlighted the particularly sensitive nature of the information involved, characterizing geolocation data as one of the most invasive forms of commercial surveillance available. The organization pointed out that such data can reveal intimate details about individuals, including their health conditions, religious beliefs, political opinions, and sexual orientation.

Because major technology companies typically establish their European headquarters in Ireland, the Data Protection Commission serves as the lead supervisory authority for Google at the continental level. The regulator confirmed that Google remains the subject of three additional ongoing investigations that are currently described as being at an advanced stage.

Among these pending proceedings is an inquiry launched in September 2024 to assess whether Google is liable for failing to conduct a proper impact assessment regarding the use of European personal data to train artificial intelligence models. For comparison within the regulatory landscape, the largest fine ever issued by the DPC remains a €1.2 billion penalty levied against Facebook parent company Meta in 2023 over data transfers to the United States.