The regulator finds infringements across three location features
Ireland's Data Protection Commission announced its final decision on 21 September in an own-volition inquiry into Google Ireland. Acting as Google's lead EU supervisory authority, the DPC examined location-data processing in Web & App Activity, Location History and Location Accuracy from 25 May 2018, when the GDPR began applying, through 4 February 2020. It imposed administrative fines totalling €403 million and ordered Google to bring the processing into compliance within six months.
The DPC says Google infringed requirements covering lawfulness and fairness in Web & App Activity and Location History, accountability in Location Accuracy, transparency across all three features, and retention in Web & App Activity and Location History. The authority says failures around location data can leave people unaware that their location is being used for purposes such as advertising or interest inference and can reduce their control over personal data.
The findings concern historical product behaviour
The inquiry period is an important boundary. The decision announcement describes processing between May 2018 and February 2020 and should not be treated as a direct audit of Google's current settings or present-day location-data flows. Reuters and the Associated Press report that Google says the case concerns historical policies and that it has changed its location practices since 2019.
Google told Reuters it now offers rolling auto-deletion, stores Timeline data on-device and gives users controls over how data including location is used for advertising. It also said searches can store a general area rather than a precise device location. Those are Google's descriptions of later product changes; the DPC announcement still requires a six-month compliance remedy following the historical findings.
The case covers account settings and Android location accuracy
Web & App Activity is an account setting that can process browsing, search and location information connected with activity on Google services. Location History, now surfaced through Timeline, records places and paths from compatible signed-in devices when a user opts in. Location Accuracy is broader because it is an Android feature that can improve device location beyond GPS and is available even to people who do not hold a Google Account.
That scope explains why the DPC treated the case as more than one location-history toggle. The authority assessed different legal and transparency obligations across separate product surfaces, including retention. The confirmed ruling does not establish that every individual user's location was used in the same way or that every present-day Android device remains affected by the conduct examined.
The full decision and any legal challenge remain open
The DPC says it will publish the full decision in due course. Until then, the public announcement establishes the infringement categories, €403 million total fine, inquiry period and six-month compliance order, but it does not expose the complete legal reasoning, fine calculation or every remedial step. Reuters says the DPC also has three separate statutory inquiries involving Google at an advanced stage.
The story is Confirmed because the regulator itself announced a final decision and independent reporting records Google's response. Community discussion is kept as discovery provenance rather than evidence. The next material update will be the full DPC decision, any formal appeal or court filing from Google, and a verifiable account of how the six-month compliance order changes the affected processing.