Ireland Fines Google €403 Million for GDPR Violations Over Location Tracking

Ireland's Data Protection Commission announced Monday it fined Google €403 million, roughly $463 million, for violating the EU's General Data Protection Regulation through its handling of users' location data. It's the fourth-largest fine the DPC has issued since GDPR took effect in 2018.

The investigation covered a specific window: May 25, 2018 through February 4, 2020. The DPC looked at three Google account settings, Web & App Activity, Location History, and Location Accuracy, and found Google violated GDPR's requirements for lawfulness, fairness, transparency, and accountability. It also found Google held onto location data longer than necessary.

"As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," said Graham Doyle, the DPC's deputy commissioner. "The retention of users' location data for longer than necessary aggravated this loss of control."

Where the complaint came from

European consumer rights groups, including the Norwegian Consumer Council and BEUC, filed complaints in November 2018 across seven countries. Their case built on Norwegian Consumer Council research documenting how Google's interface design nudged people into leaving location tracking on, even when they thought they'd turned it off. The DPC opened its formal inquiry in February 2020 as Google's lead EU privacy regulator.

If a company's settings menus are built so most users leave tracking enabled by default or by confusion, that's a design choice with consequences, not an accident. The DPC's finding that users "could have been unaware" their location data was fueling ad targeting backs that up.

Google's response

Google didn't deny the underlying facts but says they're old news. A spokesperson told multiple outlets, including the Evening Standard and Silicon Republic, that "this case centres around historical policies that have since been updated," pointing to auto-delete controls the company rolled out starting in 2019 that let users purge location data on a rolling three, 18, or 36-month basis. Google also points to a 2023 update that moved Location History timelines onto users' own devices rather than Google's servers.

Google made real changes. Whether they fully address what regulators flagged for the 2018-2020 period is a separate question, and the DPC has given Google six months to bring its current processing into full compliance, which suggests regulators don't think the 2019 and 2023 fixes closed every gap.

The bigger pattern, and Ireland's enforcement problem

This fine lands months after the European Commission hit Google with a separate €890 million penalty in July 2026 under the Digital Markets Act for anti-competitive conduct, according to Crypto Briefing. That outlet also reported Google's cumulative EU penalties, spanning antitrust and privacy cases, now top €10 billion.

But there's a wrinkle that several outlets under-reported. Global Banking and Finance Review, citing Irish public broadcaster RTÉ, notes the DPC has issued more than €4 billion in GDPR fines since 2018 but collected only about €20 million of it. Most of the big penalties, including this one against Google, sit tied up in legal appeals. Ireland's regulator has faced years of criticism for being slow to act against the Big Tech firms headquartered in its jurisdiction, Google, Apple, Meta, and others, precisely because of that pattern: announce a headline-grabbing fine, then watch it stall in court for years.

For context on scale, this Google fine ranks behind Meta's €1.2 billion penalty from 2023 for shipping European user data to the United States and TikTok's €530 million fine from April 2025, according to the DPC's own published fine records cited by Global Banking and Finance Review.

Google has not indicated whether it will appeal the €403 million penalty. Given the DPC's collection record on its other major fines, whether Ireland ever actually sees this money and on what timeline is the open question that matters more than the headline number itself.