Google fined €403m by DPC over GDPR violations

The Data Protection Commission (DPC) in Ireland has fined Google €403 million and ordered the tech giant to comply with EU privacy regulations within six months. The investigation, which lasted six years, found that Google did not adhere to the EU's GDPR when processing data generated within the bloc. The probe, initiated by complaints from European consumer rights organizations, including BEUC, examined Google's handling of location data across its 'web & app activity', 'location history', and 'location accuracy' features from May 2018 to February 2020.

The DPC's deputy commissioner, Graham Doyle, explained that users might have been unaware that their data was being used for ads or to infer their interests. He added that the retention of location data for longer than necessary worsened this loss of control. Google acknowledged the "historical policies" that were updated since 2019, stating that they have since evolved their practices and launched tools to make managing location data easier.

Since the GDPR's enactment, the DPC has issued its fourth largest fine to date. In 2023, Meta received the largest fine from the watchdog, amounting to €1.2 billion, for illegally transferring Facebook user data from the EU to the US. Earlier that year, TikTok was fined €530 million for transferring personal user data to China, and Meta faced another €405 million fine in 2022 for publicly disclosing the contact details of children using Instagram's business accounts.