Dublin, September 21, 2026 (Yes Punjab News)
The Data Protection Commission (DPC) in Ireland has imposed a 403 million euro penalty on Google for violations related to the processing and retention of users’ location data under the European Union’s General Data Protection Regulation (GDPR).
The Irish privacy regulator has also ordered Google to bring its location data processing practices into compliance within six months.
The decision was issued by the DPC’s Commissioners for Data Protection, Dr Des Hogan, Dale Sunderland and Niamh Sweeney.
The regulator found that Google infringed the GDPR in relation to the lawfulness and fairness of its processing of location data through its Web & App Activity and Location History services.
Google was also found to have breached its accountability obligations by failing to demonstrate compliance with the GDPR’s requirements concerning the lawfulness, fairness and transparency of its processing of personal data through Location Accuracy.
The DPC further found that Google retained location data collected through Web & App Activity and Location History.
Location History is a Google service that tracks a user’s location when enabled on a compatible mobile device. Users must opt in to the service, which processes location data to infer information such as places visited, activities and routes between locations.
DPC Deputy Commissioner Graham Doyle said location data can reveal significant information about individuals and therefore requires careful protection.
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” Doyle said.
He added that location data could provide benefits through online services but could also expose information that is inherently private.
The DPC said Google’s failures could have resulted in individuals being unaware that their location data was being used, including for purposes such as influencing them through advertisements or inferring their interests.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data,” Doyle said.
He added that retaining users’ location data for longer than necessary further aggravated the loss of control over their personal information.
The GDPR establishes rules for protecting personal data across the European Economic Area (EEA) and requires personal data processing to be lawful, fair and transparent.
The DPC said it will publish the full decision at a later date.
FOLLOW NOW
