Google Fined €403 Million Over GDPR Violations Tied to Location Data
Google has been fined €403 million by Ireland's Data Protection Commission (DPC) for violating GDPR regulations related to the handling of location data from 2018 to 2020. The DPC determined that Google failed to demonstrate lawful processing, transparency, and didn't retain location data for a necessary period, potentially exposing users to privacy risks and manipulation through targeted advertising. Google has since implemented changes to address these issues, but the DPC is evaluating whether these updates are adequate.
Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) for violating the EU’s General Data Protection Regulation (GDPR) concerning the handling of location data between May 2018 and February 2020. The DPC found that Google failed to adhere to GDPR principles regarding lawful processing, transparency, and data retention, leading to potential privacy violations and the possibility of users being unknowingly subjected to targeted advertising based on their location history. Specifically, the DPC determined that Google did not adequately demonstrate that its processing of location data was lawful and fair, nor did it retain the data for a period necessary for the intended purpose.
Three key Google features were under scrutiny: Web & App Activity, Location History, and Location Accuracy. Web & App Activity, a Google account setting, allows Google to process data about user activity on its sites and apps, including location information. Location History requires user opt-in but tracks user movements when signed into mobile devices. Location Accuracy uses device sensors to refine GPS location, available to users with or without a Google account.
The DPC’s investigation stemmed from complaints filed by European consumer groups, including BEUC, the European Consumer Organization, in November 2018. The inquiry began in February 2020, concluding more than 6.5 years after the initial complaints. Google has since implemented changes, including auto-delete controls for Location History and Web & App Activity, allowing users to delete their data after 3 or 18 months. In June 2020, the 18-month auto-delete became the default for new accounts and first-time users of Location History.
Furthermore, in December 2023, Google announced that Timeline, the Google Maps feature displaying Location History on a map, would retain data on users’ devices, with auto-delete defaulting to 3 months for new users of Location History. The DPC has not yet publicly stated whether these recent changes sufficiently address the original concerns and meet the terms of its order. Google can appeal the decision to the High Court within 28 days of receiving formal notice.