Ireland's Data Protection Commission (DPC) has fined Google €403 million ($462 million) for misusing users' location data in breach of the European Union's General Data Protection Regulation (GDPR), concluding an investigation that began more than five years ago. The penalty, one of the largest ever issued by the Irish watchdog, was announced on Monday and is accompanied by an order requiring Google to bring its data processing practices into full compliance within six months.

The DPC, which oversees Google at the European level because the company — like many major tech firms — bases its European headquarters in Ireland, found that Google had processed location data in ways that were neither lawful, fair nor transparent. The violations related to three specific features — Web & App Activity, Location History and Location Accuracy — and occurred between 25 May 2018, the date GDPR came into force, and 4 February 2020. The inquiry was triggered in November 2018 by coordinated complaints from consumer organisations across eight European countries, including the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia and Sweden.

DPC deputy commissioner Graham Doyle said the consequences for users were significant: individuals may have been unaware that their location data was being used to target them with personalised advertising or to draw inferences about their interests and habits. He added that Google's retention of location data for longer than necessary deepened users' loss of control over their personal information. The European Consumer Organisation (BEUC), which coordinated the original complaints, welcomed the ruling, with director general Agustin Reyna calling it confirmation of