Seven years and ten months after consumer groups across seven countries filed coordinated complaints, Ireland’s Data Protection Commission has fined Google Ireland Limited €403 million. The decision, issued on September 21, 2026, covers a 620-day window from May 25, 2018—the day the GDPR took effect—to February 4, 2020. Google now has six months to change the processing at issue.
The DPC found four infringements across three features: Web & App Activity, Location History and Location Accuracy, the Android-level setting that was not even named in the original 2018 complaints. Location data can make services more useful, but it can also reveal inherently private information.
Individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests.
That warning came from Deputy Commissioner Graham Doyle. The authority concluded that keeping location data longer than necessary aggravated the loss of control.
Why the retention finding matters for advertisers
Google says the case is about historical policies that have already changed, pointing to auto-delete controls and shorter default retention. For performance marketers, the operative finding is storage limitation. Google’s store visits conversions product models footfall by observing signed-in users with Location History enabled, then extrapolating. Retention caps directly shrink that modelling pool.
The direction of travel is already visible in the ad stack:
- Granular Google Ads reporting data is capped at 37 months from June 2026.
- Customer Match list membership is capped at 540 days since April 2025.
- Maps Timeline default retention was cut from eighteen months to three.
None of this means location-based measurement disappears tomorrow. It means the lookback horizon for observation, inference and modelling is being compressed. Growth teams should test shorter-attribution windows now rather than wait for a product change.
Brussels rewrites the same rulebook
Enforcement and policy are moving in opposite directions. On the same day, noyb published a Council of the European Union working text proposing to permit personal data processing for AI training on a legitimate-interest basis. The Commission’s proposed unconditional right to object was struck from the operative article, along with listed safeguards. Some language reappears only in a recital, which is interpretive rather than binding.
For advertising operations, the text also deletes Articles 88a and 88b, which would have moved device-access consent into the GDPR and honoured machine-readable browser consent signals. A rewritten Article 5(3) of the ePrivacy Directive creates limited consent exemptions, including contextual advertising measurement.
Addressability moves to documented consent
Commercial operators are not waiting for the rules to settle. On September 21, Permutive announced an integration with TransUnion’s identity graph covering 250 million consumers and 125 million households across more than 150 publishers. The pitch is simple: publishers have logged-in relationships and documented consent, while only about 30 percent of web traffic is addressable through a third-party cookie or alternative identifier. A financial services test campaign produced a twelvefold increase in addressable impressions and exceeded its KPI by 170 percent.
BCN and PubMatic pushed the same idea in Germany with a system covering more than 80 million consented profiles and over 1,500 signals. The practical takeaway is not that identity is dead. It is that addressability is migrating to the parts of the supply chain where consent is actually filed.
Across the Atlantic, the same pressure is visible: more than 10,000 data privacy cases have been filed in US courts since 2022, with roughly $7 billion in settlements. The fine is a reminder that privacy risk is also a targeting risk. Teams that keep relying on vague disclosures and inferred location signals will find both confidence and inventory shrinking.
Source: PPC Land
