Google fined €403M for GDPR location data breaches

Google has been fined €403 million ($463 million) by Ireland’s Data Protection Commission (DPC) for multiple violations of the General Data Protection Regulation (GDPR) involving the processing of users’ location data. The penalty, one of the largest issued under GDPR, follows an investigation into how Google collected and handled location information without proper user consent or transparency.

What happened

The DPC concluded that Google’s practices breached GDPR requirements by failing to adequately inform users about how their location data was being used or obtain explicit consent for such processing. The investigation focused on the legal basis for data collection, particularly whether users were given sufficient control over their location settings. While the exact timeline of the violations remains unclear, the fine reflects systemic issues in Google’s data handling practices rather than a single incident.

The €403 million penalty is the second-largest GDPR fine ever imposed, surpassed only by a €746 million fine against Amazon in 2021. The decision underscores the EU’s ongoing scrutiny of how large technology companies manage personal data, particularly location information, which is classified as sensitive under GDPR.

What we don’t know yet

Sources did not specify the duration of the violations or whether Google has already implemented corrective measures. It is also unclear if Google plans to appeal the decision, a common step in high-profile GDPR cases. The DPC has not released detailed technical findings from its investigation, leaving questions about the specific systems or processes that led to the breaches.