Google Fined €403 Million in Ireland Over Location and Activity Data

The Irish Data Protection Commission announced on September 21, 2026, a €403 million fine against Google Ireland across four violations, covering Web & App Activity features, Location History, and Location Accuracy on the Android system. Reuters estimated the fine at approximately $463 million, while the Commission did not detail the breakdown of the amount among the violations or how it was calculated.

According to the decision signed by Commissioners Des Hogan, Dale Sunderland, and Niamh Sweeney, the Web & App Activity and Location History features violated the principles of lawfulness, fairness, transparency, and storage limitation, while the Location Accuracy feature violated the principle of transparency alone. Google failed to demonstrate that the processing satisfied these principles, representing a failure in accountability. The investigation covered the period from May 25, 2018, to February 4, 2020, and the company was given six months to comply.

The decision came after a lengthy process: the Commission sent questions to Google on August 15, 2018, requesting an 'urgent response', then launched an own-volition investigation on February 4, 2020—538 days after the initial questions—and issued the decision 2,421 days after the investigation began. Johnny Ryan of the Irish Council for Civil Liberties stated that the word 'urgent' took over eight years, and that the decision took 2,951 days since the Commission's 2018 statement.

The Commission has not yet published the text of the decision, nor has it clarified which articles of the EU General Data Protection Regulation were breached, or whether Google will appeal. This case concerns companies and platforms operating in the European market, including Arab companies providing digital services to a European audience, because the same logic that condemned exploiting location data for targeted advertising applies to any tracking-based advertising activity, emphasizing that subsequent modifications do not erase past violations.

What Do These Terms Mean?

Irish Data Protection Commission (DPC): The regulatory body responsible for enforcing data protection rules in Ireland, acting as the primary supervisory authority for many major tech companies within the European Union.

General Data Protection Regulation (GDPR): The legal framework regulating the processing of individuals' data within the European Union, imposing clear limits on companies regarding data collection, use, and storage.

Location History: A record that saves the locations visited by a user across their devices, used to build a behavioral profile that may be used for ad targeting.

Accountability Principle: The obligation of a company to prove through clear documentation that it complied with data protection rules, rather than merely stating so during an investigation.