The Irish Data Protection Commission (DPC) announced on 21 September that it had fined Google Ireland Limited €403 million, following an inquiry into the company’s processing of location data, and ordered Google to bring that processing into compliance within six months. The press release announcing the fine and the deadline does not include the decision itself.
What did the Irish DPC decide about Google’s location data?
The DPC’s own-volition inquiry into Google Ireland Limited examined the processing of location data across three features — Web & App Activity, Location History and Location Accuracy — from 25 May 2018 to 4 February 2020. It reached four findings, mapped feature by feature: a lawfulness and fairness finding against Web & App Activity and Location History; an accountability finding against Location Accuracy, for failing to demonstrate that its processing was lawful; a transparency finding against all three features; and a retention finding against Web & App Activity and Location History. The fine totals €403 million, and Google has six months to bring its processing into compliance.
No Article Named, No Split, No Start Date
The release names no GDPR article behind any of the four findings, does not divide the €403 million among them, and does not say when the six-month compliance clock begins.
The release quotes Deputy Commissioner Graham Doyle: “Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred.” The quote describes the category of data. It does not describe which processing, under which article, produced which part of the fine.
The DPC’s release contains no statement from Google. The company’s account reached the press separately: as reported by ppc.land, Google told the Irish Examiner the case concerns historical policies, and told Yahoo Finance it had substantially changed its practices from 2019 onward, citing auto-delete cycles of 3, 18 or 36 months and controls to limit ad personalisation or location use. But the examined period runs to 4 February 2020, so a change beginning in 2019 falls inside that window, not after it. Nothing published says whether the finding covers the features as they exist today or as they existed before Google’s changes.
Earlier this month, this desk read a settlement filing that named no recipient of the data it described: Grindr’s disclosure recorded a payment and no admission of liability, not the parties who received anything. Today’s release keeps a comparable silence, one step over — not who received the data, but which article, which share of €403 million, and which date starts the clock.
Four Findings, Three Features, No Even Split
The four findings do not fall evenly across the three features. Two draw three findings each, and the third draws two, including the case’s only accountability finding rather than a finding that its processing was unlawful.
| Feature | What it is | Findings against it |
|---|---|---|
| Web & App Activity | Google account setting; processes browsing and search history | Lawfulness & fairness; transparency; retention |
| Location History | Tracks device location, displayed via Google Maps’ Timeline | Lawfulness & fairness; transparency; retention |
| Location Accuracy | Android OS feature; refines location beyond GPS alone | Accountability (failed to demonstrate lawfulness); transparency |
An Accountability Finding Is Not an Unlawfulness Finding
Accountability places the burden of proof on the controller. The DPC’s finding on Location Accuracy is that Google failed to demonstrate its processing was lawful, fair and transparent, not a finding that the processing was unlawful. The release keeps the two apart: lawfulness and fairness runs only against Web & App Activity and Location History.
The asymmetry cuts against population size. The release describes Location Accuracy as an Android operating system feature; ppc.land reports it reaches Android users regardless of whether they hold a Google account, extending the finding to people who never opened a Google account setting. It is the feature reaching the broadest population, and on lawfulness it drew only the accountability finding. Nothing published explains why.
This desk found a similar blank space this month in the EU Kids Act’s commencement date, left as a bracketed placeholder in the text, present but unfilled. Today’s release does not reach even a placeholder: the six-month clock has no stated start at all.
Where €403 Million Sits
According to ppc.land’s coverage of the decision, Reuters puts today’s fine at approximately $463 million, and TNW describes it as the fourth-largest DPC penalty since the GDPR took effect. The DPC fined TikTok €530 million in April 2025 under a similar six-month order, though Ireland’s High Court granted TikTok a conditional stay in November 2025. LinkedIn was fined €310 million in October 2024. The DPC’s €1.2 billion fine against Meta, issued in May 2023, remains under appeal.
The same coverage credits the decision to three Commissioners for Data Protection: Des Hogan, Dale Sunderland and Niamh Sweeney.
One more coincidence, unconnected to this case: ppc.land notes that 21 September is also the deadline for the 60-day compliance period on the European Commission’s €890 million Digital Markets Act fine, issued in July 2026. Different law, different regulator, same date.