Google has been fined €403 million ($463 million) by Ireland’s Data Protection Commission (DPC) over the company’s handling of users’ location information, following a regulatory investigation into whether its processing practices complied with European Union data-protection law.
The decision, announced on Monday, September 21, 2026, concerns Google Ireland’s processing of location data through services including Web & App Activity and Location History. The DPC found that Google breached the EU’s General Data Protection Regulation (GDPR) in relation to the lawfulness and fairness of that processing.
The case dates back several years. The Irish regulator opened its statutory inquiry in February 2020 after receiving complaints from consumer organisations across Europe about Google’s processing of location information and the transparency surrounding those practices.
The investigation places renewed attention on how major technology companies obtain, process and use highly revealing location information from consumers.
Location data can provide information about where people live, work, travel and spend their time, making its collection and use a major privacy concern under European data-protection rules.
The DPC’s inquiry examined two central questions:
- Whether Google had a valid legal basis for processing users’ location data.
- Whether Google provided sufficient transparency about how that information was processed.
The regulator’s investigation covered Google’s practices between May 2018 and February 2020, according to the published report on the decision.
The case originated from complaints by consumer organisations in several European countries. The Norwegian Consumer Council said its 2018 investigation into Google’s tracking practices contributed to complaints subsequently submitted by consumer groups across Europe.
Google has since changed aspects of its location-data practices. The Norwegian Consumer Council said the company introduced changes to how it obtains consent and manages location tracking following the complaints.
Ireland’s Data Protection Commission handled the investigation because Google Ireland is subject to the Irish regulator’s oversight for its European operations.
The DPC has a particularly important role in EU privacy enforcement because numerous major technology companies maintain European headquarters or significant operations in Ireland.
The regulator’s 2020 announcement confirmed that the investigation concerned Google Ireland Limited and was conducted under Ireland’s Data Protection Act 2018 and the GDPR’s cross-border cooperation framework.
The latest penalty therefore represents an enforcement action under GDPR, rather than a fine imposed under the EU’s separate Digital Markets Act.
The Google location-data penalty arrives as European authorities continue to increase scrutiny of the technology company’s business and data practices.
In July 2026, the European Commission separately imposed €890 million in fines on Google for two breaches of the Digital Markets Act. The Commission fined the company €460 million over self-preferencing in Google Search and €430 million over restrictions affecting alternative purchasing channels on Google Play.
That action is legally distinct from the latest €403 million GDPR penalty.
The European Commission has also been pursuing measures concerning Google’s handling and sharing of search data. In July, it adopted measures requiring Alphabet to provide anonymised search data to eligible third-party search engines under fair, reasonable and non-discriminatory conditions.
Taken together, the cases demonstrate that Google faces regulatory scrutiny across several different areas:
- Data privacy: Processing and transparency surrounding personal information.
- Digital competition: Treatment of Google’s own services and rival businesses.
- Data access: Requirements concerning access to anonymised search information.
- Consumer choice: Restrictions affecting how businesses communicate alternative offers.
The financial penalty is not necessarily payable immediately.
The Irish DPC states that fines imposed by the regulator become payable only after confirmation by an Irish court. If an organisation appeals a decision, the fine cannot be collected while that appeal remains pending.
The regulator’s published guidance says that, once a fine receives court confirmation, the DPC issues a payment notice requiring the organisation to pay within 28 days.
The latest decision can also be challenged through the Irish courts. The Norwegian Consumer Council said the decision may be appealed.
The development means the dispute could continue beyond the regulator’s announcement, particularly if Google challenges the findings or the amount of the penalty.
The Google case highlights the regulatory importance of transparency when companies collect information capable of revealing detailed aspects of people’s lives.
The investigation began with concerns over practices that are now several years old, and Google has subsequently made changes to its approach to location tracking. Nevertheless, the size of the penalty underlines the potential financial consequences when European regulators determine that data-processing practices failed to satisfy GDPR requirements.
For European technology users, the case also reinforces the importance of understanding what information applications and online services collect, why they collect it and the choices available for controlling that processing.
The next significant development will be whether Google challenges the decision and how the Irish courts ultimately treat the penalty.
