EU fines Google 403 million euros over location data privacy breaches

Google has been fined 403 million euros for breaching the European Union's privacy rules after regulators found it mishandled users' location data. Ireland's Data Protection Commission said on Monday that the company did not lawfully or fairly process location data across several Google services and settings.

The inquiry, opened six years ago, examined how Google applied the EU's General Data Protection Regulation from the time it took effect in 2018 until February 2020. Ireland is Google's lead regulator in the 27-nation EU because the US technology company's European headquarters is based in Dublin.

The watchdog said Google did not lawfully or fairly process location data in users' Web & App Activity, a setting that tracks browsing and search history, and in Location History, a service that maps places users have been with their mobile phones. Regulators also found the company failed to be lawful, fair and transparent in the way it processed personal data through its Location Accuracy feature in the Android mobile operating system.

Google said in a statement, "This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."

Regulators said location data is a form of personal data collected by Google that can be used to infer a person's location. Deputy Commissioner Graham Doyle said, "Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private."

The penalty is the fourth-largest EU privacy fine issued by the Irish watchdog, which has previously imposed bigger fines on TikTok and Meta, including a 1.2 billion euro fine on Meta. The regulator also said it still has three other ongoing privacy investigations involving Google. The case centres on Google's handling of location data under EU privacy rules during the period covered by the investigation.