Irish privacy regulator fines Google €403 million over location data processing

The lead EU data privacy regulator for most of the biggest internet companies fined Alphabet's Google €403 million ($463 million) after an inquiry into its ‌processing of location data, policies the search engine said have since been updated. Ireland's Data Protection Commission said on Monday it found Google had infringed European Union privacy rules known as the General Data Protection Regulation (GDPR) through three of its specific features – 'Web & App Activity', 'Location History' ‌and 'Location Accuracy' — from 2018 to 2020.

A spokesperson for Google said the case centred around historical policies, and that it had ‌launched robust tools and significantly evolved its practices on managing location data since 2019. Google, which is subject to three separate ongoing statutory inquiries that the DPC said were at an advanced stage, was nevertheless ordered by the regulator to bring its location data processing into compliance within six months.

The fine was ⁠the fourth ​largest of the more than €4 ⁠billion in total levied by the DPC since it became the lead EU regulator for most big US tech firms under the strict 2018 GDPR due ⁠to the location of companies' EU operations in Ireland. "As a result of Google's failures, individuals could have been unaware that their location was ​being used to, for example, influence them with ads or to infer their interests, and could lose control over their ⁠personal data," DPC Deputy Commissioner Graham Doyle said in a statement.

The DPC opened the inquiry in 2020 following complaints from several European consumer rights organisations, including ⁠the pan-European ​consumers' organisation BEUC, regarding Google's processing of location data. The infringements included the lawfulness and fairness of Google's processing of location data in 'Web & App Activity', an account setting that processes information related to users’ activity on Google services, and 'Location History', which keeps track ⁠of users' location through mobile devices.

Google said it has introduced updates since the period investigated that allow users to automatically ⁠delete personal data on a rolling ⁠basis, store timeline data directly on a device, and manage how data, including location, is used for ads. It also stores an estimated general area rather than a precise device location when a ‌user searches on ‌Google, it added.

($1 = 0.8712 euros)