Google’s location data privacy failures draw a €403 million fine
Ireland's DPC fined Google €403 million for location-data privacy violations and ordered compliance within six months.
The Irish Data Protection Commission fined Google €403 million ($459 million) after a six-year inquiry into location data handling from May 2018 to February 2020. Google collected location data through Web & App Activity even when users disabled Location History, as first revealed by an Associated Press investigation in 2018 and confirmed by Princeton researchers. Google previously paid roughly $1.9 billion across US settlements, including $1.38 billion to Texas and $392 million to 40 states, plus a $425 million class action verdict. The DPC ordered Google to bring location data processing into compliance within six months.
- €403 million ($459 million) fine follows six-year DPC inquiry
- Disabling Location History did not stop collection via Web & App Activity setting
- Prior US payouts total about $1.9 billion, including $1.38 billion to Texas
- Google must bring location data processing into compliance within six months
Full article600 words · extracted from malwarebytes.com · click to collapse
The Irish Data Protection Commission (DPC) has fined Google €403 million ($459 million) for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020.
During that time, Google collected users’ location data without making clear that it could be used to infer their interests and shape the ads they saw.
Google’s location history keeps track of users’ locations when using their devices. It’s an opt-in service that includes a Timeline feature to display a private map of the places they’ve visited. A separate Android feature, Location Accuracy, helps devices determine their location more accurately than GPS alone.
Google had told users that they could stop Location History tracking by turning off that setting. But a report by the Associated Press in 2018 found that doing so wasn’t enough to stop Google from saving some of that location data. Researchers at Princeton University later confirmed the AP’s findings.
One reason was Web & App Activity, a separate Google account setting that can save information about what Google account holders have been browsing on the web and doing with their apps. That service was also collecting location data. Turning off Location History did not turn off Web & App Activity.
This issue led to payouts in multiple US jurisdictions. Google agreed to pay $85 million to Arizona in October 2022, $392 million to 40 states that November, and $9.5 million to the District of Columbia the following month. It also agreed to pay $39.9 million to Washington State in 2023, $1.38 billion to Texas in May 2025 as part of a two-suit settlement. Last September, a jury awarded $425 million in a separate class action case.
The DPC first looked into the issue in 2018 after the AP investigation and launched an official statutory inquiry in February 2020. Along with the fine, it has ordered Google to bring its location data processing into compliance within six months. The DPC says it will publish the full text of its decision in due course.
Google told Bloomberg that it had revised its practices since 2019 and launched tools to make location data easier to manage. In December 2023, Google announced that it would change its Timeline feature to keep its data on users’ devices. It also said that, for people turning on Location History for the first time, the default period before data is automatically deleted would fall from 18 months to 3 months.
This isn’t the only Google-related investigation that the DPC has launched. It launched one on Google’s processing of EU residents’ data for its AI model two years ago, and another related to the processing of personal data for its online Ad Exchange in 2019.
Check your Google location settings
Turning off Timeline doesn’t stop Google from saving location information through other settings. Check Web & App Activity and, if you see it, Search Services History too.
You can turn these settings off and delete activity already saved to your account.
Browse like no one’s watching.
Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free →
About the author
Danny Bradbury has been a journalist specialising in technology since 1989 and a freelance writer since 1994. He covers a broad variety of technology issues for audiences ranging from consumers through to software developers and CIOs. He also ghostwrites articles for many C-suite business executives in the technology sector. He hails from the UK but now lives in Western Canada.