Overview
- Ireland’s Data Protection Commission announced the €403 million penalty on Monday, Sept. 21, 2026, after a probe that began in February 2020 and examined practices from May 25, 2018 to Feb. 4, 2020.
- The DPC ruled Google violated GDPR on four counts, citing unlawful or unfair processing in Web & App Activity and Location History, failures of accountability for Location Accuracy, and inadequate transparency and data retention.
- The case began with coordinated complaints from European consumer groups led by BEUC and national councils that said Google’s settings and prompts left users unaware their movements could feed ad targeting or interest profiles.
- Google responded that the decision covers historical policies changed from 2019 and pointed to tools it has added to let people manage or auto-delete location information.
- Regulators gave Google six months to bring the processing into compliance and the DPC said three other large statutory inquiries into Google — including probes of its AI training data, personalised ads, and account sign-up processes — remain at advanced stages, signalling ongoing EU scrutiny.