The decision follows an eight‑year investigation that began with a wave of complaints from consumer groups in nine European countries, from the Czech Republic to Sweden. In February 2020, the DPC opened a formal inquiry into Google's handling of geolocation data, a process that would eventually take eight years to resolve.
The DPC found that between May 2018 and February 2020, Google processed users' location data in a way that breached GDPR's principles of lawfulness, fairness and limited retention. Deputy Commissioner Graham Doyle said the company's practices left people unaware that their movements were harvested to target ads or infer personal interests, adding that the data was stored longer than necessary.
Consumer advocates hailed the ruling as a landmark win for digital privacy. BEUC director‑general Agustin Reyna called the decision "important" yet lamented the delay, warning that "late enforcement can be as harmful as no enforcement at all." The €403‑million fine is the fourth‑largest imposed by the DPC, after Meta's €1.2 billion penalty in 2023.
Google maintains that it has since updated its policies, but the DPC remains unsatisfied, ordering the company to align its practices with GDPR within six months. The regulator also keeps other investigations open, including a September 2024 probe into the company's AI training data use.
A 42‑year‑old teacher from Dublin told reporters she did not realize her commute was tracked and used to push local restaurant ads.