The Irish Data Protection Commission (DPC) has fined Google Ireland Limited €403 million after finding failures in the way Google processed location data through Web & App Activity, Location History and Location Accuracy. The decision is a reminder for every organisation using location analytics: a privacy notice and a settings screen are not controls unless they accurately describe, govern and limit the processing that actually happens.
The DPC’s announcement covers processing between 25 May 2018 and 4 February 2020. It says the full decision will be issued in due course, so this article focuses on the regulator’s published findings and the practical governance lessons they support.
What the DPC found
The DPC findings identify infringements concerning lawfulness and fairness in Google’s processing of location data in Web & App Activity and Location History. It also found an accountability failure: Google could not demonstrate compliance with lawfulness, fairness and transparency requirements for Location Accuracy. The announcement separately identifies transparency failures across all three features and excessive retention of location data in Web & App Activity and Location History.
The DPC imposed administrative fines totalling €403 million. Our GDPR fines tracker provides wider context, but this case matters for its control lessons as much as its headline, and the DPC ordered Google to bring its processing into compliance within six months. The announcement does not set out the complete reasoning or allocation of the fine between findings. Organisations should therefore avoid treating this summary as a substitute for the full decision.
Lesson one: map the real processing before choosing a lawful basis
Location data can reveal where a person lives, works, travels and spends time. The DPC describes it as personal data from which an individual’s location can be inferred, either alone or with other information. That makes a high-level statement such as “we use data to improve services” a poor starting point for governance.
Managers should require a feature-level processing map. Record what is collected, the sources, the purposes, the people or systems that receive it, the outputs created, and the points at which the data is combined with other information. Then document the lawful basis for each purpose, rather than assuming one broad basis covers every use.
- Identify each location signal, including inferred location and derived interests.
- Separate service functionality, security, personalisation, advertising and analytics purposes.
- Record whether a setting is genuinely optional and what happens when a person declines it.
- Link each purpose to its lawful basis and the evidence supporting that choice.
Lesson two: test notices and settings against the system
Transparency is an operational test, not a copywriting exercise. A notice may be clear in isolation but misleading if the product flow, default settings or back-end processing tell a different story. The DPC’s findings make that gap especially important for location analytics, where a user may not expect a service to infer movements or interests from several data sources.
Run a notice-to-system review whenever a tracking feature changes. Start with the user flow: what does a person see before activation, what choices are available, and what confirmation is given afterwards? Compare those answers with event logs, configuration, data flows and downstream uses. Have product, engineering, marketing and privacy owners sign off one shared description.
For wider context on the importance of identifying personal data, see our guide to personal data. The governance question is whether the organisation can reasonably link the data to a person or use it to infer something about them, whatever the field is called.
Lesson three: make retention defensible
The DPC identified retention failures in Web & App Activity and Location History. The GDPR’s storage limitation principle requires identifiable personal data to be kept no longer than necessary for its purposes. A retention schedule for location data should explain why each dataset is kept, the event that starts the clock, the deletion or anonymisation method, and the owner responsible for checking that it works.
Do not rely on a generic “keep for as long as necessary” statement. Test deletion in production-like systems, including backups, exports, analytics stores and derived profiles. Where a longer period is needed for a defined purpose, record the justification and review date. If the organisation cannot explain why a location record remains useful, it should not remain by default.
A practical governance review for managers
- Scope: have we mapped direct and inferred location data across every feature?
- Purpose: can we explain each use in plain language and distinguish optional from essential processing?
- Lawfulness: is a documented lawful basis tied to each purpose, with evidence?
- Transparency: do notices, settings and actual system behaviour match?
- Retention: are periods specific, owned, tested and reviewed?
- Accountability: can we produce the records, decisions and test results that demonstrate compliance?
What organisations should do now
Start with the location-enabled features that affect the most people or create the most detailed inferences. Bring the processing map, notice, settings, retention schedule and test evidence into one review pack. Escalate unresolved differences to the accountable privacy or compliance owner before expanding the feature.
The DPC’s €403 million fine is significant, but the practical message is more useful than the headline: organisations need to be able to show that their description of location processing is accurate, their choices are meaningful, and their retention is justified. Until the full decision is published, those are the controls managers can test with confidence.
Frequently asked questions
What did the Irish DPC fine Google for?
The DPC found lawfulness and fairness infringements and retention failures in Web & App Activity and Location History. The accountability finding concerns Location Accuracy: Google could not demonstrate compliance with the lawfulness, fairness and transparency principle. Transparency infringements concern all three features. The full decision has not yet been issued.
What should a location-data retention policy include?
It should define the purpose, dataset, retention period, deletion method, accountable owner and review trigger for each category of location data, including derived data and relevant copies.
Why do settings and privacy notices need to be tested together?
Because a clear notice cannot make processing transparent if the product choices or actual system behaviour differ from what the notice says.
