Google Fined $463 Million Over EU Location Data Privacy Violations
Dublin, Ireland — September 22, 2026

Google has been fined €403 million ($463 million) by Ireland’s Data Protection Commission after an investigation found that the company breached European Union privacy rules in its handling of users’ location data.

The decision concerns Google’s practices between May 2018 and February 2020 and involves three services: Web & App Activity, Location History and Location Accuracy.

Investigation Examined Location Tracking
Ireland’s Data Protection Commission, which serves as Google’s lead privacy regulator in the European Union, launched the investigation in February 2020 following complaints from European consumer organizations.

Regulators found that Google did not meet GDPR requirements for lawful, fair and transparent processing of location data through the three features.

The DPC said location information can reveal highly personal details about where people travel and what they do.

Regulators Raise Concerns Over User Control
According to the regulator, Google’s practices could have left some users unaware that their location information was being used to infer interests or influence advertising.

The investigation also found that some location data was retained longer than necessary, which the DPC said further reduced users’ control over their personal information.

Google Says Its Practices Have Changed
Google said the case concerns historical policies that have since been updated.

The company said it introduced additional tools from 2019 onward to give users more control over location information, including automatic deletion options and the ability to store Timeline data directly on a device.

Fourth-Largest Fine From Irish Regulator
The €403 million penalty is the fourth-largest fine issued by Ireland’s Data Protection Commission since it became the lead EU privacy regulator for many major U.S. technology companies.

The DPC has also ordered Google to bring its location-data processing into compliance with EU privacy requirements within six months. The regulator said three other statutory investigations involving Google remain ongoing.

The case highlights the growing regulatory scrutiny facing technology companies over how personal data is collected, stored and used.

Sources: Ireland’s Data Protection Commission; Reuters; Associated Press.