Ireland’s Data Protection Commission issued a €403 million ($463 million) fine against Google on September 21, closing out a six-year investigation into how the company collected and used the location data of its users, the fourth-largest fine the DPC has handed down since the GDPR came into force and the first it has ever imposed on Google.
What the inquiry covered
The DPC announced its final decision following an inquiry into Google Ireland Limited. The own-volition inquiry was launched by the DPC, in its role as Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from several European consumer rights organisations, including BEUC, regarding Google’s processing of location data.
The scope of the inquiry concerned Google’s processing of location data in three specific features, “Web & App Activity”, “Location History” and “Location Accuracy”, between the date of application of the GDPR, May 25, 2018, and February 4, 2020.
Regulators found failures on lawfulness, fairness, transparency, accountability and data retention.
As a result of these infringements, Google users may have been “unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data,” said DPC deputy commissioner Graham Doyle. “The retention of users’ location data for longer than necessary aggravated this loss of control,” Doyle added.
Scale of the penalty and what comes next
The €403 million penalty is the fourth largest the DPC has handed down since GDPR came into force. The largest remains Meta’s €1.2 billion fine imposed in 2023, with TikTok’s €530 million fine and a €405 million fine for Instagram completing the top three.
The fine puts Google alongside the biggest targets of European privacy enforcement, though the full amount remains contingent on legal proceedings. A DPC fine becomes payable only after an Irish court confirms it, and Google can appeal to the High Court within 28 days of formal notice. Large tech firms usually do. It is understood that Google will appeal the ruling, focused on legal issues that require clarification beyond this case.
The DPC also ordered the company to bring its processing into compliance within six months.
Google said the case centres around historical policies that have since been updated. “From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” a spokesperson said. The changes introduced by Google include settings to automatically delete data, ad management tools, and increased transparency around how data is used.
A second blow over the same feature this year
The DPC ruling is not the only large-dollar judgment targeting Google’s location settings in recent months. In September 2025, a California federal jury awarded $425.7 million to roughly 98 million users who said Google kept collecting their app activity data after they had turned off the “Web & App Activity” setting. The eight-person jury in San Francisco federal court found that Google deceived its users about a privacy switch in their account settings that would purportedly stop the company from collecting their data across third-party apps.
Just under a year later, the European regulator fined the same feature €403 million, about $463 million at the time of the decision.
The two arrived by opposite routes: the plaintiffs alleged that Google continued collecting data from third-party apps even after users disabled the “Web & App Activity” setting , while the DPC found inadequate disclosure and excessive retention for users who had not opted out of anything.
Together the two actions represent close to $900 million in combined exposure from a single product setting.
The DPC is the main watchdog for big US tech companies in Europe due to the location of their EU operations in Ireland. Ireland hosts the European headquarters of Google, Meta, TikTok, LinkedIn, and a long list of other US tech companies, which under GDPR’s one-stop-shop rule makes the DPC the lead supervisory authority for most of their cross-border data processing in the EU. That concentration has made Dublin a focal point for Big Tech enforcement across the continent.
Broader enforcement context
A total of eight consumer organisations from Norway, the Netherlands, Greece, Czech Republic, Slovenia, Poland, Sweden and Denmark had filed complaints against, or reported, the way Google tracked users’ locations, illustrating the coordinated cross-border pressure that ultimately brought the six-year inquiry to a conclusion.
The case underscores a trend regulators and security professionals have flagged repeatedly: that the greatest risks to user data privacy often stem not from external hackers but from the retention of personal data within product features users did not fully understand they had enabled.
For companies managing sensitive personal records at scale, the enforcement pattern fits what security researchers have documented in supply-chain and platform incidents: oversight gaps in how data is collected and retained can carry liabilities that dwarf the cost of preventative design.
The DPC has three other ongoing statutory large-scale inquiries open that concern Google, all of which are at an advanced stage. Google has 28 days from formal notice to decide whether to mount a legal challenge, a process that in past cases has taken years to resolve.
The fine of €403 million joins a growing ledger: Google’s regulatory commitments in Europe now span privacy enforcement, data-sharing mandates, and interoperability orders across multiple jurisdictions. The DPC’s decision notice is available at dataprotection.ie.
