Ireland's Data Protection Commission (DPC) fined Google €403 million (about $463 million) on September 21 for how it handled users' location data. The DPC is the lead privacy regulator for many big tech companies in the EU because their European headquarters are in Ireland.
What Google did wrong
The investigation covered May 2018 to February 2020 and looked at three Google settings:
- Web & App Activity
- Location History
- Location Accuracy
The DPC found that Google:
- Processed location data unlawfully and unfairly through Web & App Activity and Location History
- Was not transparent enough with users about all three features
- Kept location data longer than necessary
- Failed accountability requirements around Location Accuracy
What happens next
Google has six months to bring its data processing into full compliance.
"Location data can reveal a significant amount of information about an individual, including information that is inherently private," the DPC's Deputy Commissioner said in the decision.
Why it matters
Location tracking has been one of the most persistent privacy complaints against Google. Many users did not realize that turning off "Location History" did not stop all location tracking, because Web & App Activity could still record it.
Google has already changed several of these settings since 2020, including storing more location data on the device instead of in the cloud. But this fine shows European regulators are still willing to go after past violations years later.
Quick tip for readers
Want to check your own settings? Go to myactivity.google.com and review Web & App Activity and Timeline (formerly Location History). You can turn them off or set data to auto-delete after 3, 18, or 36 months.
Sources: Data Protection Commission, Fortune, BleepingComputer
