Google's €403M Fine Covers Three Location Settings; One Never Used the Word

One of the three features never had location in its name

Ireland's Data Protection Commission (DPC) announced its final decision against Google Ireland on September 21 and imposed fines totalling €403 million. Three features were in scope: Web & App Activity, Location History and Location Accuracy. The period runs from May 25, 2018, the day the GDPR began to apply, to February 4, 2020.

The DPC's own descriptions show how different the three are. Web & App Activity is an account setting available only to Google Account holders. When it is on, Google processes activity on its services, sites and apps, and that activity can include browsing history, search history and location data. Location History is a service users must opt into. It tracks where a compatible device goes, infers place visits and paths, and shows them on a private Timeline map, saving that map even while the user is not using a Google service. Location Accuracy is an Android OS feature that lets a device fix its position more precisely than GPS alone, and it applies to Android users whether or not they hold a Google Account.

The decision lists four infringements: the lawfulness and fairness of processing location data in Web & App Activity and Location History; accountability, because Google could not demonstrate that Location Accuracy met the lawfulness, fairness and transparency principle; transparency across all three features; and the retention of location data in Web & App Activity and Location History. Google has six months to bring its processing into compliance. The full decision will be published later.

How long the complaint took to become a decision

The DPC opened the inquiry on its own initiative in February 2020, prompted by complaints from European consumer organisations including BEUC. According to The Next Web, those complaints were filed in November 2018 and drew on research by the Norwegian Consumer Council into how Google's interfaces were designed. That is seven years and ten months from complaint to decision, or six years and seven months from the start of the inquiry. The processing under review ended in February 2020.

Google's response was about timing. A spokesperson told RTE that the case concerns historical policies that have since been updated, and that from 2019 onward the company changed its practices and launched tools that make managing location data simple, including auto-delete settings. RTE reported that Google is understood to be appealing on legal points that need clarification beyond this case. The Next Web put the fine fourth among DPC penalties since the GDPR took effect; the largest remains the €1.2 billion imposed on Meta in 2023.

The setting that bundled location with other activity is what got caught

Set the four findings against a single app and three places to check emerge. The first is where the switch sits. Web & App Activity collects search and browsing history, and location data was processed inside it. Deputy Commissioner Graham Doyle said that as a result of Google's failures, individuals could have been unaware their location was being used to influence them with ads or to infer their interests. An app that puts location collection under a larger toggle such as personalization or activity history has the same shape.

The second is retention. The DPC wrote that keeping location data longer than necessary aggravated the loss of control. The auto-delete settings Google says it introduced from 2019 are the answer to this line item. If there is no document that says how long location logs are kept, this item is empty.

The third is proof. What was found against Location Accuracy was not the processing itself but accountability: Google could not demonstrate that the processing met the lawfulness, fairness and transparency principle. Because it is an Android feature, it reaches people with no Google Account at all, and the record of why the processing happened the way it did was not there. This is the gap that opens first in a small team. The processing is running; the reasons for it were never written down.

The invoice arrived six years after the processing stopped

Line up the dates and the order is clear. The processing ended on February 4, 2020, the inquiry opened that month, and the decision came in September 2026. Google's statement that it changed its practices from 2019 sits on the same timeline. The review of what happened before the change continued after the change. Fixing a settings screen today changes what happens next; it does not erase what was recorded before.

The other detail is where the complaint came from. This inquiry did not start with individual users. Consumer organisations filed it, and their basis was a report that analysed the product's screens. A design can become the subject of an inquiry without a queue of user complaints behind it. For an app with users in Europe, the wording and structure of the settings screen is itself the evidence.

The other number teams in Korea received this month

In Korea, an amendment to the Personal Information Protection Act took effect on September 11 and created three situations in which the penalty cap rises to 10% of total turnover: repeated and serious violations, large-scale harm, and failure to comply with a corrective order. Two of the three turn on prior enforcement rather than the size of the incident. Read alongside a Google decision that landed six years after the processing ended, keeping a record of the date a sanction was received and the date remediation was completed pays off under both regimes.

The DPC said the full decision will follow. Whether the lawfulness finding on Web & App Activity turns on the scope of consent, and how far it reaches, cannot be settled until the text is out. What can be checked before then is which setting your app's location switch sits under.