Ireland’s Data Protection Commission has closed out a six-year investigation into Google by fining the company €403 million for the way it collected and retained location data on its users. The regulator found that Google processed location information in Web & App Activity, Location History, and Location Accuracy between May 2018 and February 2020 without the lawful basis or transparency that GDPR requires, inferring personal interests from users’ movements and retaining historical location trails for longer than necessary. The fine is the fourth largest the Irish DPC has issued since GDPR came into force, behind Meta’s €1.2 billion sanction in 2023. Google has been given six months to bring its practices into compliance.
What makes this ruling worth paying attention to is not the dollar figure, which Google can absorb without blinking, but the specificity of what the DPC called out. The complaint was not that Google collected location data; it was that users were not told clearly enough what was being collected, inferred, or sold onward through advertising. For years the industry treated the location field in your settings as a yes/no toggle. The DPC’s decision treats it as a chain of consequences — pings, inferences, retention, ad-targeting — and demands that each link be defensible on its own terms. That is a materially higher bar than the one Google has been operating under, and it echoes the same direction of travel US regulators and courts have taken this year, from the FTC’s crackdown on commercial location data to the US Supreme Court’s recent ruling that geofence warrants constitute a Fourth Amendment search.
But the ceiling of what any single enforcement action can accomplish is lower than the headline suggests. Google ended its Sensorvault location database at the end of 2023 and still ended up on the receiving end of a nine-figure fine for conduct that happened years earlier. The settlement history is already stacking up — see Google’s $135M Android settlement from July for a US parallel — and the location-data industry it anchors is still largely intact. Fines are a tax on past behaviour. They are not a redesign of the business model, which continues to depend on knowing, with uncomfortable precision, where you have been.
That is where the only durable protection lives: in the choices you make about what to let onto your phone in the first place. Incognito Browser, the best free privacy browser for Android, was built around the opposite assumption of Web & App Activity: your browsing session is yours, nothing is stored on the device once you close the app, and the trackers that normally stitch together your movements across sites are blocked by default. Ireland’s regulator has told Google it has six months to fix what it should have been doing for the last six years. You can install Incognito Browser free on the Google Play Store and stop waiting on Mountain View to decide how much of your location is yours to keep.
