Ireland’s Data Protection Commission has fined Google €403 million over its handling of location data, a case that began with complaints from consumer groups in seven European countries in November 2018.
The ruling covers two account-level settings — Location History and Web & App Activity — and Android’s Location Accuracy feature. The DPC found that Google breached lawfulness and fairness rules for location data processed through the two settings, fell short on transparency across all three features, kept location data longer than necessary, and could not demonstrate accountability for Location Accuracy.
Google has six months to change how it processes the data. The full decision has not yet been published, so the precise reasoning remains to be seen.
What the regulator found
- Lawfulness and fairness: Google breached GDPR principles when processing location data through Location History and Web & App Activity.
- Transparency: The legal basis for processing was unclear across Location History, Web & App Activity and Location Accuracy.
- Retention: Location data was kept longer than necessary, increasing users’ loss of control.
- Accountability: Google could not show that Location Accuracy processing complied with core GDPR principles.
Deputy Commissioner Graham Doyle said retaining users’ location data for longer than necessary made their loss of control worse.
The long road to enforcement
The original complaint was filed on 27 November 2018 by consumer organisations in Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland and Sweden. The decision lands 2,855 days later — roughly seven years and ten months.
Part of that delay came from structural change. In January 2019, Google Ireland Limited became the data controller for users in the European Economic Area and Switzerland, which directed cross-border GDPR complaints about Google’s European processing to the Irish regulator.
Why it matters for advertisers
This is not just a privacy story. Location signals feed ad targeting, measurement and attribution across Google’s network. If Google has to tighten how location data is collected and retained, expect stricter consent prompts, pressure on location-based audiences and more scrutiny on the legal basis for ad personalisation.
The compliance order also lands in a changed enforcement environment. The European Data Protection Board has steered platforms away from contract and legitimate interest for behavioural advertising, and IAB Europe’s Transparency and Consent Framework removed legitimate interest for profiling in version 2.2. The message for ad-funded businesses is increasingly blunt: consent is the safe default for location-based advertising.
What marketers should do
Audit default settings. If location or personalisation is switched on by default, treat that as a compliance risk. The complaint specifically called out pre-ticked boxes and design flows that pushed users toward consent.
Unbundle consent. The consumer groups argued that users who wanted photo grouping by place had to accept the full Location History package, including advertising uses. Separating functional uses from ad purposes reduces that risk.
Document your legal basis. If you rely on legitimate interest for behavioural ads, reassess it against current EDPB guidance. Controllers are systematically underestimating what the balancing test requires.
Review retention windows. Location data should not sit indefinitely. Set clear deletion schedules and make pausing collection separate from deleting historical data.
For growth teams, the takeaway is practical: privacy decisions now shape campaign targeting, audience availability and attribution. Companies that treat consent as a design constraint, rather than a legal afterthought, will have a more durable measurement stack.
Source: PPC Land
