Google hit with €403M privacy fine over handling of user location data

The Irish data protection authority has imposed a €403 million fine on Google for its handling of user location information, marking the fourth largest penalty issued by the Irish regulator and the first major punishment against Google. This decision concludes an inquiry that began in 2020 following complaints from consumer organizations across the EU regarding Google's handling of location data and the lack of transparency in its processing practices.

Google violated the General Data Protection Regulation (GDPR) on four counts, according to the three Irish privacy commissioners: Des Hogan, Dale Sunderland, and Niamh Sweeney. These concerns centered on Google's processing and storage of location data in its Web & App Activity, Location History, and Location Accuracy features, as well as concerns about transparency.

Consumer groups alleged that Google had employed deceptive tactics and unfair practices to encourage users to enable features that shared their location data. The Irish Data Protection Commissioner (DPC) has three other ongoing investigations against Google, which involve Google's PaLM2 AI model, personalized advertising system, and account sign-up process.

A Google spokesperson stated that the case centers around historical policies that have since been updated, with the company implementing significant changes in 2019 and launching robust tools to make managing location data straightforward. Agustín Reyna, the director general of the European Consumer Organisation (BEUC), commented that the decision is positive for consumers as it holds Google accountable and confirms the illegality of the tech giant's methods for obtaining consent to use people's location data.

However, he also noted that the time taken to reach this conclusion is disproportionate to the severity of the infringement, emphasizing the need for faster and better protection of consumers' fundamental rights.