Google was sentenced on Monday to a fine of 403 million euros (more than 330 million €) in the European Union for having violated European rules on the geolocation data of its users, almost eight years after complaints from consumer associations, which denounced the slowness of the procedure.
This fine from the Irish Data Protection Commission (DPC) is the fourth largest ever imposed by the body, responsible for supervising Google at European level, because the group’s headquarters for Europe, like most tech giants, is in Dublin.
According to Graham Doyle, Deputy Commissioner at the DPC, quoted in a press release, geolocation data can certainly “improve the usefulness of online services”, but also “reveal a significant amount of information about a person, including intrinsically private information”.
However, “due to the American giant’s breaches of the European data protection regulation (GDPR), Google users “could not be aware that their location was being used, for example, to influence them through advertisements or to infer their interests”.
Google now has six months to change its practices and comply with the GDPR, which aims to better protect the personal data of Europeans, strengthens the rights of Internet users and establishes clear obligations for companies in the processing of data.
“Late application”
“Location data can be incredibly sensitive, because it reveals a lot about our personal lives: where our children go to school, how many times someone has visited a hospital or even a place of prayer,” explains Agustín Reyna, director general of BEUC, the European consumer organization.
In November 2018, his organization coordinated complaints from several European consumer defense associations – in Norway, Greece, Czech Republic, Slovenia, Poland, Sweden and the Netherlands – accusing Google of manipulating its users to “spy” on their movements.
The DPC investigation was opened a few months later, in February 2020. It focused on the compliance with the GDPR of the “Activity on the web and applications”, “Location history” and “Location precision” functionalities offered by Google.
Monday’s decision “confirms the illegality of the way in which the technology giant obtained consent to use location data,” welcomes Agustín Reyna.
“However, the time required to reach this conclusion is disproportionate to the seriousness of the offense. Delayed enforcement can be as harmful as its absence. The fundamental rights of consumers must be better and more quickly protected,” he added.
Three other investigations
“This case concerns historical policies which have since been updated,” responded a Google spokesperson. “Since 2019, we have evolved our practices significantly and launched robust tools that make managing location data simple.”
Google is currently the subject of three other DPC investigations, “all at an advanced stage”, according to the organization. Among them are a procedure opened in September 2024 to determine whether it can be criticized for not having carried out an impact study on the use of Europeans’ personal data before using it to train its artificial intelligence.
The heaviest fine decided by the DPC hit Meta in 2023: 1.2 billion euros concerning the transfer of data to the United States, despite fears of surveillance at the time by American services.
