Google hit with €403m fine by Irish data watchdog over GDPR violations

ByEmmet McElhatton BBC News NI. 21 September 2026, 13: 26 BST.

Key points

• Google has been fined €403m (£345m) by the Republic of Ireland's Data Protection Commission (DPC) over its handling of location data.
• On Monday the DPC remarked its investigation identified Google had processed data in a manner that was not "lawful", "fair" or "transparent".
• Along with being fined, Google has additionally been ordered to bring its data processing into compliance within six months.
• In an official note, Google remarked: This case centres around historical policies that have since been updated.
• Location data is any kind of data which can be applied to infer a person's location.

After complaints from a number of European consumer rights organisations, the penalty – one of the largest of its kind imposed by the Irish watchdog authority – followed an inquiry introduced into the tech giant six years ago.

For context, the inquiry concerned Google's processing of location data in three specific features – Web & App Activity, Location History and Location Accuracy between 25 May 2018 to 4 February 2020.

It can "reveal a significant amount of information about an individual, including information that is inherently private", remarked DPC deputy commissioner Graham Doyle in an official note issued on Monday.

For context, the report remarked Google's practices "infringed" General Data Protection Regulation (GDPR) – legislation that came into effect on 25 May, 2018, creating strict data privacy and security law within the European Union (EU).

Doyle continued: "The GDPR (General Data Protection Regulation) provides a high level of protection of personal data throughout the EEA (European Economic Area), and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner."

He continued: Since of Google's failures. Individuals could have been unaware that their location was being employed to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.

"The retention of users' location data for longer than necessary aggravated this loss of control."

Along with being fined, Google has additionally been ordered to bring its data processing into compliance within six months. How have Google responded?

In an official note, Google remarked: "This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and introduced robust tools that produce managing location data simple."

They additionally stated they have created data protection improvements over recent years, including "industry-first auto-delete controls". It enables all users to "set your account to automatically delete your data on a rolling three, 18, or 36-month basis".

Other measures to safeguard personal data have additionally been introduced, they stated, such as "simple ads management". It allows you "to turn off personalized ads entirely", and "increased transparency", including "consolidated detailed information about our location data practices and account settings".

Taken together, the developments around google hit with €403m fine by Irish data watchdog over GDPR violations point to a situation that is still moving, and the coming days should bring more clarity.