Irish Data Protection Commission Imposes Fine on Google Ireland Limited
The Irish Data Protection Commission (DPC) has published a final decision against Google Ireland Limited. The subject matter was an inquiry initiated by the DPC into the processing of location data in connection with certain services and products. According to the European Data Protection Board, the final decision was adopted on 21 September 2026.
The DPC imposed fines on Google Ireland Limited totalling EUR 403,000,000. In addition, the company was ordered to bring the contested processing operations into compliance with the requirements of the General Data Protection Regulation (GDPR) within six months.
Background to the Inquiry
Lead Role of the Irish Supervisory Authority
The addressee of the decision is Google Ireland Limited. As the European headquarters of the Alphabet group, the company falls, according to the published information, within the jurisdiction of the Irish Data Protection Commission as the lead supervisory authority.
The inquiry was initiated by the DPC on its own initiative in February 2020. It was prompted by complaints previously submitted by several European consumer organisations, including BEUC, in connection with Google’s processing of location data.
The original complaints were filed in November 2018 by consumer organisations from several European states, including Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland and Sweden. According to the information published in this regard, German, Austrian or Swiss organisations were not among the complainants.
Connection with Investigations by the Norwegian Consumer Council
According to the available reports, the complaints were based, among other things, on investigations by the Norwegian Consumer Council Forbrukerrådet. According to those investigations, Google is alleged to have designed user interfaces in such a way that the Location History and Web & App Activity functions remained enabled. This account is based on the consumer organisations mentioned and the reports published in this regard.
The DPC did not examine the matters in general terms, but in relation to specific functions and a specific period. The inquiry covered the processing of location data between 25 May 2018, the date on which the GDPR became applicable, and 4 February 2020.
Subject Matter of the Decision
Three Functions in Focus
According to the communication from the European Data Protection Board, the inquiry concerned three specific functions:
- “Web & App Activity”,
- “Location History”,
- “Location Accuracy”.
According to further reports, the examination concerned, among other things, location settings in services such as Google Search and Google Maps, as well as the location accuracy function on Android devices.
The focus was therefore on processing operations that may have considerable practical significance for the use of digital services and mobile devices. However, the decision concerns only the functions named in the inquiry and the period specified there.
Relevant Provisions of the GDPR
The DPC based its decision on provisions of the General Data Protection Regulation. The publication by the European Data Protection Board specifically refers to the following provisions:
- Art. 5 GDPR on the principles relating to processing of personal data,
- Art. 6 GDPR on the lawfulness of processing,
- Art. 12 GDPR on transparent information, communication and modalities for the exercise of the rights of data subjects,
- Art. 13 GDPR on information obligations where personal data are collected from the data subject.
The decision comprises both a fine and an order to establish a condition compliant with data protection law.
Findings of the Data Protection Commission
Lawfulness and Fairness of Processing
According to the published summary, the DPC found infringements of the GDPR in connection with the lawfulness and fairness of the processing of location data. These findings relate to the “Web & App Activity” and “Location History” functions.
The decision therefore does not concern all conceivable processing of location data by Google, but rather the specifically examined functions and the defined inquiry period. This limitation is decisive for the legal assessment.
Accountability Obligations for “Location Accuracy”
In addition, the DPC criticised compliance with accountability obligations under the GDPR in relation to “Location Accuracy”. According to the published decision, Google was unable to demonstrate, with respect to this function, that the principles of lawfulness, fairness and transparency were observed in the processing of personal data.
The finding therefore concerns the obligation to demonstrate compliance in relation to the processing of personal data in “Location Accuracy”. It must be distinguished from the further findings regarding the “Web & App Activity” and “Location History” functions.
Transparency Obligations for All Three Functions
The DPC also found infringements of transparency obligations. These findings related to all three functions mentioned: “Web & App Activity”, “Location History” and “Location Accuracy”.
Art. 12 GDPR and Art. 13 GDPR require that information be provided to data subjects in a transparent, intelligible and easily accessible form. According to the published summary, the DPC’s decision turns on the question of whether Google had met these requirements in relation to the functions examined.
Storage of Location Data
A further part of the decision concerns the storage of location data. According to the communication from the European Data Protection Board, the DPC criticised the retention of location data in “Web & App Activity” and “Location History”.
Deputy Commissioner Graham Doyle stated, according to reports in Irish media, that data subjects may not have known that their location data was used, for example, to influence advertising and to infer interests. According to this reasoning, the excessive retention period had exacerbated the loss of control over the data concerned.
Amount of the Fine and Further Procedural Aspects
Classification of the Fine
The fines imposed amount in total to EUR 403,000,000. In reports, the amount was converted to approximately USD 463 million or around CHF 380 million.
According to Irish media reports, this is the fourth-highest fine imposed by the Irish Data Protection Commission to date. According to those reports, the decision was adopted by the three Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney; the communication from the European Data Protection Board does not name the Commissioners individually.
Six-Month Implementation Period
In addition to the fine, the DPC ordered Google to bring the processing into compliance with the GDPR within six months. The order relates to the contested processing operations addressed in the decision.
According to the reports available immediately after publication, it was not known whether Google would lodge an appeal against the decision. The company statement reproduced in the reports did not contain any comment on this point.
Reactions to the Decision
Statement by Google
According to published reports, Google stated that the matter concerned earlier or historical practices. Since 2019, the company said it had further developed its procedures and introduced tools enabling users to manage location data more easily.
This statement does not alter the fact that the DPC’s decision concerns the period from 25 May 2018 to 4 February 2020. The decisive factors remain the supervisory authority’s findings on the processing operations examined in the inquiry.
Assessment by Consumer Organisations
BEUC Director General Agustín Reyna welcomed the decision as important, according to published reports. He saw it as confirmation that the obtaining of consent in connection with location data had been unlawful.
At the same time, BEUC criticised the duration of the proceedings. According to the organisation, around eight years elapsed between the complaints and the decision. In its assessment, delayed intervention may have a similarly detrimental effect to a failure to intervene.
Data Protection Significance for Companies
The decision illustrates the high practical relevance of transparency, lawfulness, fairness and accountability obligations in the processing of personal data. This applies in particular to location data, because such data may allow conclusions to be drawn about the movements, habits and interests of data subjects.
For companies with data-driven business models, the case shows that supervisory authorities examine not only the formal existence of information and settings. It is also important whether the processing operations are explained in a comprehensible manner and whether compliance with the relevant principles can be demonstrated.
According to the published information, three further major statutory inquiries against Google are currently ongoing at the DPC, each of which, according to the authority, is at an advanced stage. No statement can therefore be made as to their outcome.
Advice on Data Protection and GDPR Compliance
The decision of the Irish Data Protection Commission underscores that data protection infringements can have significant economic and regulatory consequences. Particularly in the context of international data processing, digital business models and the use of location-based data, complex questions frequently arise regarding the GDPR, information obligations and the accountability obligation.
MTR Legal Rechtsanwälte advises companies, investors and high-net-worth private individuals on data protection law matters with a commercial law dimension. Further information can be found under legal advice in data protection law.
