[Enforcement library](/enforcement)

# Google Ireland: location controls need clear purposes, lawful processing and retention limits

The DPC imposed EUR 403 million in fines concerning Google's Web & App Activity, Location History and Location Accuracy features.

## Key facts

- **Regulator or court:** Irish Data Protection Commission (DPC)
- **Jurisdiction:** Ireland / European Union
- **Framework:** GDPR Articles 5, 6, 12 and 13
- **Record date:** 2026-09-21
- **Procedural status:** Administrative fines and six-month compliance order; full decision not reviewed

The DPC imposed EUR 403 million in fines concerning Google's Web & App Activity, Location History and Location Accuracy features.

Irish Data Protection Commission (DPC) · GDPR Articles 5, 6, 12 and 13 · Decision: 21 September 2026

## The problem

Location can be inferred from several services. A control for one feature does not explain or govern every other route that processes location information.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Irish Data Protection Commission (DPC) |
| Jurisdiction | Ireland / European Union |
| Law | GDPR Articles 5, 6, 12 and 13 |
| Decision date | 21 September 2026 |
| Recorded fine | EUR 403,000,000 |
| Procedural status | Administrative fines and six-month compliance order; full decision not reviewed |
| Source review | 19 October 2026 |

Primary record: [DPC announcement](https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location).

## What the authority found

The DPC's inquiry concerned processing from 25 May 2018 to 4 February 2020. It found infringements involving lawfulness and fairness, accountability, transparency and retention across the three features. [DPC announcement](https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location).

The announcement distinguishes a Google account activity setting, an opt-in location-history service and Android's Location Accuracy feature. It says the full decision would be issued separately. [Authority notice on EDPB](https://www.edpb.europa.eu/news/the-irish-data-protection-commission-fines-google-403-000-000-eur-following-inquiry_en).

## Outcome and limits

The DPC announced administrative fines totalling EUR 403,000,000 and a six-month order to bring processing into compliance. This record relies on that announcement and does not establish subsequent compliance, appeal results or payment. [DPC announcement](https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Map every source of precise and inferred location, including SDKs, account activity and backend enrichment.
- Test what each setting actually stops and make the explanation match the full set of processing routes.
- Document purpose-specific retention and verify deletion behaviour with service owners.

## How Inth helps

Code audit can trace vendor calls in reviewed code, while Website audit can record observable browser destinations.

These tools do not inspect Google's internal account services, native Android location controls or a recipient's retention practices.

## Sources and limits

- [DPC announcement](https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location)
- [Authority notice on EDPB](https://www.edpb.europa.eu/news/the-irish-data-protection-commission-fines-google-403-000-000-eur-following-inquiry_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.