Google hit with €403M privacy fine over handling of user location data

In a significant privacy ruling, the Irish data protection authority has fined Google €403 million for mishandling user location data. This marks the fourth largest fine issued by the Irish regulator and marks Google's first major penalty. Ireland is tasked with enforcing EU privacy rules against numerous tech giants operating within the country.

The fine comes after a 2020 inquiry into Google's practices, initiated by the Irish Data Protection Commission in response to complaints from consumer groups across the EU. The regulator found Google in violation of the EU’s General Data Protection Regulation (GDPR) on four counts, related to the collection, storage, and transparency of location data from its Web & App Activity, Location History, and Location Accuracy features.

Consumer groups alleged that Google employed deceptive tactics to persuade users to enable location sharing. Despite Google’s acknowledgment of historical policy changes in 2019, the company’s actions were found to be unlawful. The Irish DPC is currently investigating Google’s use of its PaLM2 AI model, personalized advertising system, and account sign-up process.

Google’s spokesperson acknowledged the historical policies had been updated, highlighting their recent improvements in managing location data. Agustín Reyna, director general of the European Consumer Organisation (BEUC), commended the ruling, stating it holds Google accountable and confirms the illegality of obtaining consent for location data usage.

However, he noted the lengthy process in reaching this decision is disproportionate to the severity of the infringement.