On 21 September 2026, Ireland's Data Protection Commission (DPC) announced a €403 million fine against Google Ireland Limited. The decision closes an own-volition inquiry opened in February 2020, after complaints from several European consumer organisations, including BEUC. It covers three features: Web & App Activity, Location History and Location Accuracy. The period examined runs from the GDPR's date of application, 25 May 2018, to 4 February 2020.
The strongest case for the fine
Regulators have a serious argument here, and it deserves a fair hearing. Location data is unusually revealing. DPC Deputy Commissioner Graham Doyle noted that it can reveal a significant amount of information about an individual, including information that is inherently private. The DPC's concern, as reported by RTÉ, is that people could have been unaware their location was being used to influence them with ads or to infer their interests. It also said that keeping the data longer than necessary aggravated the loss of control.
The findings are specific rather than sweeping. According to the DPC, Google infringed the GDPR in these ways:
- It breached the lawfulness and fairness principles in its handling of location data in Web & App Activity and Location History.
- It breached transparency obligations across all three features.
- It breached retention rules in Web & App Activity and Location History.
- It failed its accountability obligation, meaning it could not demonstrate compliance with lawfulness, fairness and transparency, in Location Accuracy.
The last finding is narrower than the others. For Location Accuracy, the DPC did not say Google's processing was unlawful. It said Google could not show that it was lawful. That distinction is legally coherent, and it puts the burden of proof where the GDPR places it, on the controller.
What the decision does not tell us
The DPC's public announcement does not itemise how the €403 million divides across the infringements. It also does not give the GDPR article numbers, so outside observers cannot yet see how much weight each finding carried. Until the full decision text is scrutinised, any claim about which practice drove the size of the fine is speculation. The publication should not pretend otherwise.
The temporal gap is the more important point. The conduct examined ended in February 2020, and the decision arrived more than six years later. Google's response, as reported by RTÉ, is that the case concerns historical policies that have since been updated. It says that from 2019 onward it has significantly evolved its practices, adding tools such as automatic deletion settings and ad management controls. The DPC has not endorsed those claims in its announcement. The company also says it will appeal, focusing on legal points that need clarification beyond this case.
Both sides can be right at once. Users were exposed to opaque location practices in 2018–2020, and a regulatory cycle this long is a poor instrument for changing behaviour in a product that ships updates weekly. A fine that lands six years after the conduct works as retrospective accountability. It gives companies little guidance about what to build next.
The compliance order is the real policy lever
The DPC has also given Google six months to bring its processing into compliance. That is where proportionate regulation can succeed or fail. If the order targets the practices the DPC actually found problematic, meaning clear disclosure and defined retention limits, it can be implemented and verified. If it demands open-ended redesign of location services, it risks degrading legitimate features such as navigation, safety alerts and fraud detection, which depend on location signals that users knowingly enable.
Consent is central to how these disputes are resolved. The European Data Protection Board's Guidelines 05/2020 on consent set out the standard regulators apply to data controllers. Many of the frictions in the case, such as bundled settings, unclear descriptions and defaults, are questions of how a valid choice is presented. Companies that read those guidelines carefully should treat this decision as a reminder that interface design is a compliance matter, not just a product decision.
An evidence-based reading
Three points follow for policymakers who want privacy protection without collateral damage to the open internet and to innovation.
First, enforcement should move faster. Investigations that take six years to reach a decision reward delay and blunt deterrence. Better-resourced regulators, and clearer procedural deadlines within the GDPR's cooperation mechanism, would serve users better than larger fines.
Second, remedies should be tied to outcomes. A six-month order is more valuable if regulators publish measurable criteria for compliance, such as retention periods, disclosure wording and default states. Companies could then test against them, and smaller firms could learn from them.
Third, the appeal is a feature of the system, not a failure of it. Google has said it will seek legal clarification. If courts define more precisely what lawfulness, fairness and transparency require for location data, every developer gains certainty. Regulators should welcome that clarity, not treat it as obstruction.
The fine is large in absolute terms, but its lasting value depends on whether the compliance order and any court ruling produce rules that are specific, testable and applicable to firms far smaller than Google.