Ireland fines Google €403 million over location data and orders a six-month fix

Google Ireland was not transparent about how three consumer tools used location data, Ireland's Data Protection Commission found Monday, and users could have been unaware that where they went was being used to influence ads. The Dublin regulator, the European Union's lead authority for Google Ireland, imposed administrative fines totaling €403 million and ordered the company to bring the processing into compliance within six months.

For anyone who holds Alphabet, that cash penalty is small against the company's last reported quarter, and it may not be paid for years. DPC guidance says a fine is not payable until a court confirms it; if no appeal is filed, the DPC applies to the Circuit Court for confirmation, and an appeal blocks collection while it runs. The Irish Times reported in January that of €4.04 billion in DPC fines levied over six years, €4.02 billion remained uncollected.

The processing the commissioners reviewed ran from May 25, 2018, when the EU's General Data Protection Regulation, or GDPR, took effect, through February 4, 2020. The decision landed Monday, more than six years later. The part that can still touch the business is the order: it reaches into location features that sit behind Google's advertising machinery, and it is the only piece of Monday's ruling that puts a deadline on the product. The DPC did not publish the date it notified Google, which is what starts the six months, and Monday's public note does not say what has to change.

What the DPC says Google got wrong

The decision covers Web & App Activity, Location History and Location Accuracy. The DPC opened the inquiry in February 2020 after complaints from European consumer groups including BEUC.

On Web & App Activity and on Location History, Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney found Google processed location data without a lawful or fair basis, was not transparent about that processing, and kept the data longer than necessary. On Location Accuracy, they found a failure of accountability: Google could not demonstrate it had complied with lawfulness, fairness and transparency. Transparency was the finding that ran across all three. The public announcement did not cite numbered GDPR articles. The DPC said it will issue the full decision in due course.

Deputy Commissioner Graham Doyle put the harm in advertising terms. "As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," he said. "The retention of users' location data for longer than necessary aggravated this loss of control."

A Google spokesperson said the case "centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple." Google has pointed to auto-delete controls, introduced in 2019, that let users wipe location data on a rolling three-, 18- or 36-month basis. Those controls were already arriving during the period under review.

Agustín Reyna, director general of BEUC, called the decision "good news for consumers" and said it "confirms the illegality of the way the tech giant obtained consent to use people's location data," but said the time taken was "disproportionate." He did not describe what Google now has to rebuild.

Irish law still gives Google a path. Under section 150 of the Data Protection Act 2018, a person affected by a legally binding DPC decision may appeal within 28 days of receiving notice, in the Circuit Court or the High Court. The court may annul the decision, substitute its own determination, or dismiss the appeal. Google has not said whether it will.

How €403 million ranks against other EU cases

Alphabet reported second-quarter revenue of $119.8 billion and operating income of $40.8 billion for the three months ended June 30. Other income included a $98.0 billion net gain, primarily unrealized gains on equity securities, which is why net income is the wrong yardstick for a cash fine. EMEA, the region this case sits in, contributed $32.5 billion, or 27% of that quarter's sales. The €403 million penalty is about $463 million. Alphabet does not disclose how much advertising revenue depends specifically on location data.

The Irish Times described the €403 million penalty as the DPC's fourth-largest since GDPR took effect. Three DPC fines sit above it: Meta Ireland's €1.2 billion announced on May 22, 2023, over EU-to-U.S. transfers; TikTok's €530 million announced on May 2, 2025, over transfers of EEA user data to China; and Meta's €405 million Instagram fine announced on September 15, 2022, over children's data. Those cases were about different conduct. This one is about location.

It also arrives after two much larger European Commission penalties against Google: €2.95 billion on September 5, 2025, for favouring its own ad-tech services, and €890 million on July 23, 2026, in two Digital Markets Act decisions on Search self-preferencing and Play restrictions. Those are separate legal tracks, not a single accounting total, and Monday's privacy case does not reopen them.

U.S. cash equities have not yet opened on the decision. Alphabet sits in communication services on standard sector maps, so plain U.S. technology funds typically omit it. The concentrated exposure is Vanguard's U.S. communication services fund BVOX, graded B against other communication-services funds under etf.net's published method; the letter carries no mission score. As of September 20 the fund held Alphabet Class A at 14.16% and Class C at 7.80%, 21.96% combined.

The DPC has not published the decision that would tell anyone what the six-month order requires, or whether the location tools Google says it rebuilt from 2019 already satisfy it. That is the record Monday left.