"Late enforcement can be as harmful as no enforcement at all," BEUC director general Agustín Reyna said after Ireland's Data Protection Commission issued a record penalty against Google.
How the DPC summarizes the breaches
Ireland's Data Protection Commission (DPC), acting as Google's lead EU regulator, concluded that three Google features mishandled people’s location data between May 2018 and 4 February 2020. The DPC found that Web & App Activity and Location History breached the GDPR's rules on lawful and fair processing and on transparency, and that Google retained location data longer than necessary. For Location Accuracy — an Android feature that refines device position beyond GPS and is available with or without a Google account — the DPC's findings were narrower: it concluded Google broke transparency and accountability obligations because it could not demonstrate that the processing was lawful, fair and transparent.
Exactly which Google settings and features were involved
The decision names three specific features. Web & App Activity is a Google account setting that, when turned on, allows Google to process data about a user's activity on its sites and apps, and that data can include location. Location History, which users must opt in to, "keeps track of where they go with their signed-in mobile devices, even when they are not using a Google service." Location Accuracy is described by the DPC as a distinct Android capability available to device users whether or not they have a Google account.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePenalty, compliance order, and legal next steps
The DPC imposed a fine of €403 million and ordered Google to make its processing comply with the GDPR within six months. The DPC has not publicly specified which processing the compliance order covers and said its full decision will be published later. At €403 million, the agency said the fine is the fourth-largest it has issued. The fine cannot be collected until an Irish court confirms it; Google may appeal to the High Court within 28 days of receiving formal notice of the decision.
Google's response and the company's product changes
In a statement reported by the Associated Press, Google said the case "centers around historical policies that have since been updated" and that it has "changed its practices significantly since 2019." The DPC examined a period that included several of those product changes: in May 2019 Google announced auto-delete controls for Location History and Web & App Activity that let users have that data deleted automatically after either three or 18 months. In June 2020 Google made an 18-month auto-delete the default for Web & App Activity on new accounts and for anyone turning on Location History for the first time. Later, in December 2023, Google announced that Timeline, the Google Maps feature that shows Location History on a map, would keep its data on users' devices, and that auto-delete would default to three months for anyone turning on Location History for the first time. The DPC has not said publicly whether these changes satisfy its compliance order.
What this means for end users, consumer advocates, and regulators
- End users: The DPC framed its findings around effects on individuals — saying people could have been unaware that their location was being used, "for example, to influence them with ads or to infer their interests," and that longer retention reduced users' control of their personal data.
- Consumer advocates: BEUC, which helped trigger the investigation through member groups that filed complaints in November 2018, welcomed the decision but criticized the time it took; as Agustín Reyna put it, late enforcement can itself be harmful. The DPC opened its inquiry in February 2020 and the decision arrived more than 6.5 years after that opening.
- Regulators and courts: The fine and the compliance order now move into the Irish court system for confirmation, and Google has an explicit 28-day appeal window once it receives formal notice. The DPC also signaled it will publish the full decision later, which will be material to national data protection authorities and other regulators watching enforcement outcomes.
The DPC's ruling blends concrete technical findings about specific Google features with procedural outcomes that keep the matter active in court. The published decision that the DPC has promised, and the Irish court's handling of the confirmation and any appeal, will determine whether the agency's orders lead to operational change on the ground — and whether Google's post‑2019 product updates meet the regulator's requirements.
