Google hit with €403 million GDPR fine over location tracking

Ireland’s Data Protection Commission (DPC) has fined Google €403 million (about $463 million) over its processing of users’ location data and ordered the company to bring that processing into compliance within six months.

The inquiry examined Google’s practices from May 25, 2018, to February 4, 2020. The DPC launched it on its own initiative in February 2020 after receiving complaints from several European consumer-rights organizations, including the European Consumer Organisation (BEUC).

The regulator found GDPR violations concerning the lawfulness and fairness of Google’s processing of location data through Web & App Activity and Location History.

It also found that Google had violated its accountability obligations by failing to demonstrate compliance with the GDPR’s principle of lawfulness, fairness, and transparency in its processing of personal data through Location Accuracy. Other violations concerned transparency across all three features and the retention of location data through Web & App Activity and Location History.

“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control,” Graham Doyle, Deputy Commissioner, said.

The DPC said the full decision would be published later.