Google fined €403 million by Ireland’s data watchdog for location data breach

Ireland’s Data Protection Commission just handed Google a €403 million bill for playing fast and loose with user location data. The fine, equivalent to roughly $463 million, lands as one of the largest GDPR penalties ever issued by the Irish regulator, which serves as the lead privacy enforcer for most US tech giants operating in Europe. The penalty stems from Google’s processing of location data collected between May 25, 2018, and February 4, 2020, a period during which the DPC found the company failed to adequately inform users about how their whereabouts were being tracked, stored, and monetized. What Google got wrong The inquiry kicked off after complaints from multiple European consumer rights organizations flagged Google’s handling of location data. Their core argument: users had no real idea their location information was being fed into targeted advertising systems and used to infer personal interests. The DPC agreed. After completing its investigation, the commission concluded that Google violated GDPR requirements around lawfulness, fairness, transparency, and accountability. Deputy Commissioner Graham Doyle put it plainly. “Location data is personal data, and users must m...