Google fined €403M by Irish watchdog over location data

Alphabet's Google must rework how it collects and keeps user location data across the European Union, after Ireland's Data Protection Commission closed a six-year inquiry with a penalty of €403 million, or about $463 million.

"As a result of Google's failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests," Graham Doyle, deputy commissioner at the Data Protection Commission, said.

The inquiry found breaches of lawfulness and fairness in location data processed through Web & App Activity and Location History, of transparency across those settings and a third, Location Accuracy, of Google's accountability obligations, and of the rules governing how long data is retained. The findings cover May 2018 to February 2020. The commission opened the case on its own initiative in February 2020, acting as Google's lead supervisory authority in the European Union, after consumer groups including BEUC complained. Those complaints were filed in November 2018 by organizations in seven countries and drew on Norwegian Consumer Council research into how Google's interface design steered users into leaving tracking switched on.

The penalty is immaterial to Alphabet's balance sheet — roughly 0.1 percent of the $350.0 billion in revenue the company reported for 2024 — but the remediation order is not. Google has six months to bring its processing into line, which puts product changes to location settings and the advertising signals built on them on a fixed clock rather than an open-ended compliance roadmap.

The fourth-largest fine, and the smallest of the four

At €403 million, the DPC's action ranks behind the €1.2 billion the regulator imposed on Meta in 2023 for transferring Europeans' personal data to the United States, and behind two other penalties the commission has levied since the GDPR took effect in May 2018. Google's fine is the smallest of that top four, a detail that matters for how the sector reads the decision: the DPC has now issued its largest penalties against the same structural problem — how platforms obtain and use consent for data that feeds advertising — rather than against novel legal theories.

Google disputed the framing. A spokesperson told the Irish Examiner the case concerns "historical policies that have since been updated," pointing to auto-delete controls introduced from 2019. That defense does not remove the deadline, because the order applies to processing the commission found unlawful during the review period, not only to current settings.

The decision lands on a sector already carrying a measurable GDPR cost base. Meta's €1.2 billion penalty remains the largest single fine issued under the regime, and the DPC has been the primary enforcement channel for U.S. platforms because most of them book European operations through Dublin. For Alphabet, the direct cash cost is a rounding error against a business that generated $350.0 billion in 2024 revenue. The indirect cost is the constraint on how location signals can be collected, retained, and fed into ad targeting — the mechanism that converts user data into measurable ad performance.

What six months buys Google

The remediation window is the operative number. Google has until roughly late March 2027 to satisfy the commission, and the changes it makes will apply across the European Union, not just Ireland, because the DPC acts as lead supervisory authority for the bloc. Location Accuracy, the third setting named in the findings, is the one most directly tied to advertising utility: it governs how precisely a device's position is inferred, and precision is what makes location-based ad inventory valuable to buyers.

Alphabet shares traded little changed on the decision, consistent with a penalty that represents about 0.1 percent of annual revenue. The relevant question for investors is not the €403 million but whether the DPC's order forces changes that degrade the targeting data Google sells — a slower-moving risk that shows up in ad pricing rather than in a one-time charge.

The last time the DPC issued a penalty of this scale against a U.S. platform, Meta's 2023 transfer ruling, the company appealed and the underlying data-flow question remained unresolved for more than a year. Google has not said whether it will appeal. If it does, the six-month clock and the appeal run in parallel, and the compliance changes may take effect before the legal question is settled. If it does not, the deadline stands as written, and the next signal to watch is what Google changes in Location Accuracy and Location History settings before it lapses.

This article is for informational purposes only and does not constitute investment advice.