Ireland’s Data Protection Commission has fined Google Ireland €403 million and given it six months to bring three location-related features into line with GDPR. The decision covers Web & App Activity, Location History and Location Accuracy for conduct between 25 May 2018 and 4 February 2020.
For digital marketers, this is not just another privacy headline. The DPC explicitly linked the findings to advertising: location data can be used to influence people with ads or infer their interests, and users may not have realised that was happening.
At €403 million, the fine is the fourth-largest DPC penalty since GDPR took effect. It also lands on the same day as Google’s separate Digital Markets Act compliance deadline, a reminder that platform data practices are under pressure from several regulators at once.
What the regulator found
The Irish watchdog found GDPR breaches across lawfulness and fairness, transparency, accountability and retention. Web & App Activity and Location History drew the broadest findings; Location Accuracy was cited for transparency and accountability. Google Ireland says the case focuses on historical policies that have since been updated, and points to auto-delete controls, personalised-ad opt-outs and on-device Timeline storage.
Deputy Commissioner Graham Doyle framed the harm simply: “Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.”
In its advertising-specific observation, the DPC said individuals could have been unaware that their location was being used to influence them with ads or infer interests.
Why this matters for performance teams
Location is not just a privacy input. It feeds local targeting, audience inference and offline measurement. Google’s store-visits conversions are modelled from signed-in users who have location history enabled, interact with an ad and later visit a business. That makes location-based settings a quiet dependency in many performance dashboards.
The retention finding also deserves attention. Storage limitation means personal data should be kept only as long as necessary. The DPC said keeping location data longer than necessary “aggravated this loss of control.” Google has already been narrowing some data windows, but this ruling pushes the conversation further.
What to do now
- Map every location signal feeding your audiences, bidding or measurement.
- Tighten retention windows for location-tied data and document the lawful basis.
- Make consent copy explicit about ad use and interest inference, not just product functionality.
Google may challenge the decision, and the DPC has not yet published the full text. The six-month compliance clock could end up in court, as happened with TikTok’s earlier order. But waiting for the full decision is a risk when location-based targeting is already under regulatory pressure across Europe and the United States.
For growth teams, the practical move is to treat location data as a visible, consent-backed part of the ad stack rather than an invisible signal. If a user cannot understand that their location may influence ads or reveal interests, the value chain gets fragile—even when the technology still works.
Source: PPC Land
