Google fined €403 million over how it tracks and retains users' location data

The Irish Data Protection Commission has fined Google €403 million for breaches of EU data protection rules in its processing of users' location data and ordered the company to bring the processing into compliance within six months.

Ireland is the lead regulator for Google in the 27-nation EU because the US tech giant's European headquarters is based in Dublin.

The DPC said the decision followed an inquiry launched in February 2020 after complaints from several European consumer rights organisations, including the European Consumer Organisation (BEUC), regarding Google's processing of location data.

The inquiry examined Google's processing of location data through "Web & App Activity", "Location History" and "Location Accuracy" between May 25, 2018, when the General Data Protection Regulation (GDPR) came into effect, and February 4, 2020.

Web & App Activity is a Google account setting that allows the company to process information related to users' activity on Google services, including browsing history, search history and location data.

Location History, which requires users to opt in, tracks locations from compatible mobile devices and can use the data to infer places visited, activities and routes.

Location Accuracy is an Android feature that enables devices to determine location more accurately by using inputs beyond the device's GPS unit. It is available to Android users irrespective of whether they hold a Google Account.

The DPC found that Google infringed the GDPR on several counts, including the lawfulness and fairness of its processing of location data through Web & App Activity and Location History.

It also found Google failed to meet its accountability obligations by not being able to demonstrate compliance with the GDPR's lawfulness, fairness and transparency requirements in relation to Location Accuracy.

The regulator further found breaches of transparency obligations across all three features and said Google retained location data through Web & App Activity and Location History for longer than permitted.

"Location data is a type of personal data which is processed by way of location tracking," DPC Deputy Commissioner Graham Doyle said.

"Individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," Doyle said.

The retention of users' location data for longer than necessary aggravated this loss of control, he added.

“This case centres around historical policies that have since been updated," Google said in a statement. "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple.”