EU data regulator fines Google more than $460 million for location data violations

The Irish Data Protection Commission has imposed a substantial fine of €403 million, approximately $462 million, on Google LLC for unlawfully collecting users' location data, violating the General Data Protection Regulation (GDPR). This breach occurred due to three Google features: Web & App Activity, Timeline, and Google Location Accuracy (GLA).

Web & App Activity, a default setting in Google accounts, gathers user data, including location, to tailor search results and advertisements. Timeline, available upon user consent, compiles location history into a map for users to review their past locations and traveled routes. GLA, a component within Google's technology, collects precise location data from Android devices, employing GPS signals when available or resorting to cellular or Wi-Fi network signals when GPS data is absent.

Ireland's Data Protection Commission initiated the investigation into Google's practices in 2020, focusing on the period from May 25, 2018, when GDPR took effect, to February 4, 2020. The commission concluded that Google had contravened GDPR principles of lawfulness, fairness, and transparency, which necessitate clear disclosure of data collection practices and retention periods.

The commission has fined Google and mandated a six-month timeline for the company to rectify its GDPR-compliant data collection methods. In response, Google stated that the issue pertains to outdated policies from prior to 2019, emphasizing their recent enhancements and introduction of user-friendly tools for managing location data.