Event / Security

Google GDPR Location Data Fine

← All events

Updated

Ireland's Data Protection Commission fined Google 403 million euros for GDPR violations related to misuse of user location data between 2018 and 2020. Users were not adequately informed that location data was being used for targeted advertising and interest profiling. Google stated it has reformed these practices, with three additional DPC investigations into Google ongoing.

1 reported locations
Geography of the reported facts
  1. Dublin, Ireland

The story so far

Daily activity

3 articles
0 articles

2026-09-21 to 2026-11-03 · UTC publication dates

Coverage begins 21 Sept, 17:58 UTC

Follow the documented timeline or explore the related reporting.

What happened

The facts
  1. Irish data protection regulator fines Google 403 million euros for GDPR violations on location data

    The Irish Data Protection Commission (DPC) imposed a fine of 403 million euros on Google on September 21, 2026, for violations of the EU's General Data Protection Regulation (GDPR) regarding the use of users' location data. The DPC supervises Google at the European level as the company's European headquarters is located in Dublin. This was the fourth largest fine ever issued by the DPC. The investigation, which began in February 2020 following complaints from multiple European consumer protection organizations, covered the period between 2018 and 2020 and examined compliance with GDPR requirements for the features 'Web and App Activity,' 'Location History,' and 'Location Accuracy.'

    1 corroborating report

  2. Google users were unaware their location data was being used for advertising and profiling

    According to the DPC investigation, Google violated GDPR regulations by failing to inform users that their location data was being used to influence them through targeted advertising and to infer their interests. Users were unable to maintain control over their personal data because they were not adequately informed about these practices. The location data could reveal sensitive personal information about individuals that was intrinsically private in nature.

    1 corroborating report

  3. Meta received 1.2 billion euro fine from DPC in 2023 for data transfer violations

    The Irish Data Protection Commission's largest fine to date was imposed on Meta in 2023 in the amount of 1.2 billion euros. That fine concerned the transfer of data to the United States despite concerns at the time about surveillance by American intelligence services.

    1 corroborating report

  4. Three additional DPC investigations into Google are at advanced stages

    The Irish Data Protection Commission is currently conducting three other investigations into Google, all of which are at advanced stages, according to the DPC.

    1 corroborating report

  5. Google states it updated location data practices significantly from 2019 onwards

    Google responded to the fine by stating that the case concerned historical rules that have since been updated. The company stated that starting in 2019, it substantially evolved its practices and launched robust tools to simplify location data management for users.

    1 corroborating report

Read the coverage