Ireland’s Data Protection Commission has fined Google €403 million ($463 million) over multiple GDPR violations related to the company’s processing of users’ location data.
The investigation began in February 2020 after the DPC received complaints from several consumer rights organizations. It examined three Google features that were operating during the period from May 25, 2018, to February 4, 2020: Web & App Activity, Location History, and Location Accuracy.
Web & App Activity allows Google Account users to have activity across Google services processed, which can include information such as search and browsing activity and location-related data. Location History is an opt-in feature that can track places, activities, and routes associated with a user’s compatible mobile device and display the information through Google Maps Timeline. Location Accuracy is an Android feature designed to improve positioning beyond what GPS alone can provide and does not require a Google Account.
The DPC found that Google processed location data through Web & App Activity and Location History without meeting certain GDPR requirements. It also determined that Google failed to demonstrate compliance with GDPR principles when processing personal data through Location Accuracy.
The Irish regulator said Google failed to provide sufficient transparency across all three features and retained location data collected through Web & App Activity and Location History for longer than necessary.
The DPC said these practices could have left users unaware that their location information was being used for purposes such as influencing advertising or inferring interests, while also reducing their control over their personal data.
As part of the enforcement action, the DPC imposed administrative fines totaling €403 million and ordered Google to bring its data-processing practices into compliance within six months. The regulator has not yet published the full decision but said it will make it available at a later date.
Google said the case relates to historical policies that have since been changed. The company said it has significantly updated its practices since 2019 and introduced tools designed to make location data easier for users to manage.
Google has also introduced controls allowing users to choose how long certain account data is retained before automatic deletion. The company said Google Maps Timeline information is now stored directly on users’ devices and automatically deletes data older than three months.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Google also said that Web & App Activity no longer stores a precise device location, instead using an estimated general area.
