Google fined €403 million over location data violations

Ireland's Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations tied to the processing of users' location data.

The investigation began in February 2020, following a series of complaints from consumer rights organisations. The regulator examined three Google features that were active during the GDPR application period, from 25 May 2018 to 4 February 2020.

Three features under scrutiny

The probe covered settings that let Google process web and app activity, location history, and location-accuracy data.

Web & App Activity — a setting for Google Account holders that permits processing of activity across the company's services, potentially including browsing history, search history and location data.

Location History — an opt-in service that tracks users carrying compatible mobile devices. It can infer visited places, activities and routes, showing them in a private Google Maps Timeline even when the person is not actively using a Google service.

Location Accuracy — an Android feature that helps a device pinpoint its position more precisely than GPS alone. It is available regardless of whether the user holds a Google Account.

What the commission found

The DPC concluded that Google processed location data through Web & App Activity and Location History without meeting GDPR requirements, and that for Location Accuracy the company failed to demonstrate compliance with the regulation's principles. All three features fell short of transparency obligations, and location data from the first two was kept longer than necessary.

"Individuals could have been unaware that their location was being used, for example, to influence them with ads or to infer their interests, and could lose control over their personal data," said Deputy Commissioner Graham Doyle. The excessive retention, he added, only aggravated that loss of control.

Alongside the €403 million fine, the regulator has ordered Google to bring its data processing into compliance within six months. The full decision has not yet been published.

Google's response

In a statement to BleepingComputer, Google said the case centres on "historical" policies that have since been updated. Since 2019, it says, it has rolled out tools for easy location-data management: users can set an automatic deletion window, Google Maps Timeline data is now stored on the device and cleared of entries older than three months, and Web & App Activity keeps only an estimated general area rather than precise coordinates.

Source: Bleeping Computer