Google has been fined €403 million (£345 million) by Ireland’s Data Protection Commission (DPC) over its handling of users’ location data.
The penalty followed a six-year investigation triggered by complaints from European consumer rights organisations.
The DPC said Google unlawfully, unfairly and non-transparently processed location data through Web & App Activity, Location History and Location Accuracy between May 25, 2018, and February 4, 2020.
It said location data could reveal sensitive personal information, while Google’s practices may have left users unaware that their data could be used to influence advertisements or infer their interests.
DPC Deputy Commissioner Graham Doyle said the practices breached the General Data Protection Regulation (GDPR), which requires personal data to be processed lawfully, fairly and transparently.
The commission also ordered Google to bring its data processing practices into compliance within six months.
Google said the case concerned historical policies that had since been updated.
“From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” the company said.
It cited measures including automatic data deletion options, simplified advertising controls and greater transparency around location data practices and account settings.
