Google fined more than RMB 3 billion for unlawful collection and processing of personal information

Ireland's Data Protection Commission fined Google 403 million euros, about RMB 3.095 billion, for GDPR breaches in processing user location data. The regulator ordered Google to complete remediation within six months.

Ireland's Data Protection Commission (DPC) fined Google 403 million euros, about RMB 3.095 billion, for repeated breaches of the General Data Protection Regulation (GDPR) in how it processed user location and other sensitive personal information. The decision was reported on 22 September 2026. The DPC also ordered Google to finish remedial work within six months so that its processing of user data meets GDPR requirements.

Investigation window and the three features

The DPC opened the inquiry in February 2020 after complaints from several consumer-rights organizations. Investigators reviewed three features that Google ran during the GDPR period from 25 May 2018 to 4 February 2020. The features govern permissions for Google to process user data: Web & App Activity, Location History, and Location Accuracy.

Web & App Activity is a Google Account setting. When enabled, it can allow Google to process a user's activity across Google services. That activity may include browsing history, search history, and location data.

Location History is a service that users must switch on. Even when a user is not actively using a Google service at the time, the service can track users who carry a compatible mobile device, infer places visited, activities, and trips, and show that information on a private Timeline in Google Maps.

Location Accuracy is an Android function that helps a device determine its position more precisely than GPS alone. The function can run whether or not the user has a Google Account.

Transparency failures and excess retention

The DPC found that Google did not meet GDPR requirements when it processed location data through Web & App Activity and Location History. For Location Accuracy, Google did not produce evidence that its processing of personal data complied with the relevant GDPR principles.

The Irish regulator said Google failed its transparency duties on all three features. Location data collected through Web & App Activity and Location History was also kept longer than necessary.

DPC deputy commissioner Graham Doyle said users may not know what their location data is used for. The data may be used to deliver ads that influence purchasing decisions or to infer a user's interests. Users may therefore lose control of their personal data. He said storing location data beyond the required period further reduced that control.

The DPC has not yet published the full investigation decision. It said the decision would be released later.

Ordered fix and Google's stated changes

The administrative fine is 403 million euros. Google must complete corrective measures within six months and bring user-data processing into line with GDPR.

Google told media that it had already updated related practices and policies and had released tools that let users manage location data more easily. A Google spokesperson said the case concerns historical policies that have been updated. The company said that since 2019 it has substantially changed related practices and introduced tools for managing location data.

Google has added controls that let users set automatic deletion periods for account data. Google Maps Timeline information is now stored on the user's device, and data older than three months is deleted automatically. Google also said Web & App Activity does not store a device's precise location and instead stores only the approximate area where the user is located.

Coverage cited a BleepingComputer report at https://www.bleepingcomputer.com/news/security/google-fined-403-million-over-location-data-privacy-violations/