Google Ireland: location controls need clear purposes, lawful processing and retention limits

The DPC’s inquiry concerned processing from 25 May 2018 to 4 February 2020. It found infringements involving lawfulness and fairness, accountability, transparency and retention across the three features. DPC announcement.

The announcement distinguishes a Google account activity setting, an opt-in location-history service and Android’s Location Accuracy feature. It says the full decision would be issued separately. Authority notice on EDPB.

The DPC announced administrative fines totalling EUR 403,000,000 and a six-month order to bring processing into compliance. This record relies on that announcement and does not establish subsequent compliance, appeal results or payment. DPC announcement.

These are implementation checks suggested by Inth, not additional findings about the company.

• Map every source of precise and inferred location, including SDKs, account activity and backend enrichment.
• Test what each setting actually stops and make the explanation match the full set of processing routes.
• Document purpose-specific retention and verify deletion behaviour with service owners.

Code audit can trace vendor calls in reviewed code, while Website audit can record observable browser destinations.

These tools do not inspect Google’s internal account services, native Android location controls or a recipient’s retention practices.

• DPC announcement
• Authority notice on EDPB

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.