Google fined €400m by watchdog after use of location data found to breach protection rules
Google users could have been unaware that their location was being used to influence them with ads or to infer their interests, an inquiry found
Google has been fined more than €400million (£345million) after an inquiry found it breached data protection regulations.
Listen to this article
The tech giant was handed the huge fine following complaints from multiple European consumer rights organisations about the tech giant’s processing of location data.
The inquiry, launched by Ireland’s Data Protection Commission (DPC) into Google Ireland, began six years ago and examined the lawfulness and fairness of Google’s processing of location data and Google’s accountability obligations under general data protection regulation (GDPR).
It found that Google users could have been unaware that their location was being used to influence them with ads or to infer their interests.
The inquiry looked at “web and app activity”, “location history” and “location accuracy” between May 25, 2018 and February 4, 2020.
Read more: EU fines Google £759m for breaching competition laws on search and app store
Read more: Google's AI model Gemini hacked into three companies during cybersecurity test
The DPC has imposed administrative fines totalling 403 million euro and ordered Googleto bring its processing into compliance within six months.
It is the fourth largest fine issued by the DPC since the GDPR came into effect.
Deputy commissioner Graham Doyle said: “Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred.
“Location data can bring both benefits and harms to individuals.
“It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.
He added: “The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.
“The retention of users’ location data for longer than necessary aggravated this loss of control.”
A Google spokesperson said: “This case centres around historical policies that have since been updated.
“From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
Changes included allowing users to set their account to automatically delete their data on a rolling three-, 18-, or 36-month basis as well as the introduction of settings allowing users to turn off personalised ads entirely and manage how their location data is used for ads.
Meanwhile, Google “Timeline” data is now stored directly on users’ devices.
Google also said it does not not store precise device location in users’ Web & App Activity when searches are made, instead saving an “estimated general area”.
There are three other ongoing statutory large-scale inquiries open that concern Google, all of which are at an advanced stage.