Ireland’s Data Protection Commission has fined Google €403 million over how it handled location data across three features, one of which is a setting built directly into Android. The decision closes an inquiry the regulator opened in February 2020 after complaints from European consumer groups including BEUC.
The DPC’s inquiry covered “Web & App Activity,” “Location History,” and “Location Accuracy” — the last one described in the regulator’s own release as “a feature of Android OS that allows an Android device to determine its location with greater accuracy than simply relying on inputs from the GPS unit in the device.” It’s available to any Android user, whether or not they’re signed into a Google account, which is what pulled a phone-level feature into an EU privacy inquiry usually aimed at account settings.
What the DPC Found
The ruling, made by Commissioners Dr Des Hogan, Dale Sunderland, and Niamh Sweeney, covers conduct between May 25, 2018 — the day GDPR took effect — and February 4, 2020. It identifies four separate infringements: unlawful and unfair processing of location data in Web & App Activity and Location History; a failure to demonstrate compliance with transparency requirements specifically in Location Accuracy; inadequate transparency across all three features; and retaining location data longer than necessary in Web & App Activity and Location History.
Beyond the €403 million fine, Google now has six months to bring its data processing into compliance. Deputy Commissioner Graham Doyle put the consumer stakes plainly:
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control.”
That’s the core consumer complaint in one line: people using a phone setting meant to improve GPS accuracy may not have realized it was also feeding an ad-targeting and interest-profiling pipeline, and Google kept that data around longer than the DPC says it needed to.
Why This Matters Beyond Ireland
Location Accuracy isn’t an obscure toggle — it sits in every Android phone’s location settings, and most people leave default settings alone. The DPC’s finding that Google couldn’t demonstrate its handling of this specific feature met GDPR’s fairness and transparency bar is a direct statement about how a stock Android setting worked for roughly 20 months, not just about an account dashboard buried in google.com settings.
The DPC says it “will issue the full decision in due course,” and as of this writing, no Google statement on the ruling has surfaced in any of the outlets covering it. Google can still appeal an Irish DPC decision through Irish courts, as it and other companies have done with past rulings from the same regulator.
Source: Data Protection Commission
