The Irish Data Protection Commission (DPC) fined Google a total of 403 million euros over the processing of users’ location data. The decision dated 21 September 2026 covers practices between 25 May 2018 and 4 February 2020. The investigation addressed the Web & App Activity, Location History and Location Accuracy settings. The DPC determined that users were not sufficiently informed about data use and the legal basis for processing, and that retention periods also did not comply with the GDPR.
Why it matters
The central issue in the case is not so much the technical collection of location data as how this processing was explained to users and on what legal basis it was justified. In this respect, the decision highlights the question of how well users could understand the role of settings such as Web & App Activity, Location History and Location Accuracy in data use. The finding concerning retention periods shows that retaining data is also considered a separate obligation under the GDPR. The fact that the decision is limited to practices during a specific period in the past shifts the open question to what Google did, in line with these assessments, regarding the way it informed users and its data retention processes; the text contains no information on this matter.
Background
Google is not a new name in the FikirPilot archive: we have published 60 news reports mentioning the name in the past 90 days; the most recent is dated 26 September 2026.