Written by: Haim Ravia, Dotan Hammer
On September 21, 2026, the Irish Data Protection Commission (DPC) concluded its inquiry into Google Ireland Limited’s processing of location data and imposed a fine of €403 million. The inquiry covered three features — Web & App Activity, Location History and Location Accuracy — over the period from May 25, 2018 , to February 4, 2020.
The DPC found that Google’s processing of location data through Web & App Activity and Location History was neither lawful nor fair; that Google failed to meet its transparency obligations in respect of all three features; that it could not demonstrate compliance with the transparency principle in relation to Location Accuracy, in breach of the accountability obligation; and that location data in Web & App Activity and Location History was retained for longer than necessary. The Commission observed that users “could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests.”
Alongside the fine, the DPC ordered Google to bring its processing into compliance within six months. The decision was adopted following the cooperation and assistance of peer supervisory authorities under the GDPR’s one-stop-shop mechanism. Deputy Commissioner Graham Doyle emphasized that location data can reveal significant and inherently private information about individuals, and that the GDPR requires such processing to be lawful, fair and transparent. For organizations that collect location data as a by-product of other functionality, the decision is a reminder that the transparency and retention analysis must be conducted feature by feature rather than at the level of the product as a whole.
Click here to read the Data Protection Commission’s announcement of the fine against Google.
