Ireland's Data Protection Commission (DPC) has assessed Google a €403 million ($463M) penalty for breaching GDPR requirements in its handling of location information from users. The investigation, which began in February 2020 following complaints lodged by consumer advocacy groups, examined three distinct Google services that operated between May 25, 2018, and February 4, 2020.

The three features under investigation

The DPC scrutinized the following Google capabilities:

  • Web and App Activity – A Google Account setting enabling the company to monitor user actions across its ecosystem, encompassing search queries, browsing patterns, and positional data.
  • Location History – An optional feature that monitors movement of users with compatible devices, capturing visited locations, inferred activities, and travel routes, then presenting this data through a personal Google Maps Timeline regardless of active service use.
  • Location Accuracy – An Android capability that enhances positional precision beyond GPS capabilities alone, accessible independent of Google Account status.

Violations identified

The DPC determined that Google gathered location information via Web & App Activity and Location History in violation of GDPR standards. Furthermore, the company could not substantiate that its Location Accuracy processing adhered to GDPR principles.

The Irish regulator found that Google neglected transparency requirements across all three services. Additionally, the company maintained location records obtained through Web & App Activity and Location History beyond what was necessary for legitimate purposes.

[...] individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users' location data for longer than necessary aggravated this loss of control.

Deputy Commissioner Graham Doyle

Enforcement action and compliance timeline

The DPC has imposed combined administrative penalties of €403 million and mandated that Google modify its data handling practices to achieve compliance within six months. The regulator has indicated it will release its complete decision at a later date.

Google's response

Google stated that it has revised its historical policies and introduced mechanisms for streamlined location data administration. According to a company representative, "This case centers around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."

The company has introduced controls permitting users to establish retention windows for automatic data removal from their accounts. Google Maps Timeline data now resides on user devices and automatically purges entries exceeding three months in age.

Google also clarified that Web & App Activity does not retain exact device coordinates but instead stores an approximate geographic area.