Ireland’s Data Protection Commission announced Monday a final decision fining Google €403 million over how it handled location data in three features. The inquiry covered processing between May 25, 2018 and Feb. 4, 2020. The regulator also ordered the company to bring its processing into compliance within six months.
What the regulator found
The commission, known as the DPC, said it opened the inquiry on its own initiative in February 2020, after complaints from several European consumer rights organizations, including BEUC, the European Consumer Organisation. It covered Web & App Activity, Location History and Location Accuracy. The DPC found that Google infringed the GDPR, the EU data protection law, over:
- The lawfulness and fairness of its processing of location data in Web & App Activity and Location History.
- Its accountability obligations, by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle for its processing of personal data in Location Accuracy.
- Its transparency obligations across all three features.
- Its retention of location data in Web & App Activity and Location History.
Per the DPC, Web & App Activity is an account setting, open only to Google Account holders, that when enabled processes activity data that can include browsing history, search history and location data. Location History tracks users’ location on compatible mobile devices, requires opt-in, and feeds a Timeline map in Google Maps. Location Accuracy is an Android feature that determines a device’s location more precisely than GPS inputs alone, available whether or not users hold a Google account.
DPC Deputy Commissioner Graham Doyle said users “could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.”
The Irish Times, PA and Politico describe the fine as the fourth-largest fine the DPC has issued since the GDPR took effect.
How long it took
The examined period runs about 20 months by our count. The inquiry opened in February 2020, so the decision came more than six years later.
What Google says, and what its own pages show
A Google spokesperson said the case concerns “historical policies” that have since been updated, and that from 2019 onwards, “we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
Google’s own dated posts announce two changes. On May 1, 2019, inside the period the DPC examined, it announced auto-delete controls letting users keep activity data for 3 or 18 months, for Location History and Web & App Activity. On Dec. 12, 2023, after the period, it announced Timeline would be saved on the device, and that for users newly turning on Location History, auto-delete would default to three months, previously 18.
The posts show when Google announced changes; they do not show whether those changes address any of the DPC’s four findings.
Unconfirmed reports of an appeal
RTÉ reported, citing no named source, that Google is understood to plan an appeal, and tied it to legal issues that require clarification beyond this case. The Irish Times reported, also without naming a source, that Google may appeal elements of the decision. The Google comments quoted above do not mention an appeal.
What is not yet public
The DPC said it will issue the full decision “in due course.” Its announcement does not say how the €403 million divides among the findings, when the six months start, or which current versions of the features the six-month order covers.
What the complainants say
BEUC, which coordinated the complaints, said eight consumer organizations from Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland, Sweden and Denmark filed or reported complaints in November 2018 over how Google tracked users’ locations, based on research by its Norwegian member, Forbrukerrådet.
BEUC Director General Agustín Reyna said in the group’s statement: “The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data.” He added: “Late enforcement can be as harmful as no enforcement at all.” Reyna’s words are BEUC’s own reading; the DPC’s four findings, listed above, are worded differently.
What Google’s help pages say
Google’s Maps Help page says Timeline saves visits and routes on each signed-in device, kept according to the user’s auto-delete settings, or until the user deletes it; if the user backs up Timeline, Maps saves an encrypted copy of the data on Google’s servers. Google’s Account Help page says Timeline is off by default and has its own switch in the Timeline section of the Google Account, describes deleting data in whole or in part, and warns that with Timeline off, a Google Account may still save location data through other settings such as Web & App Activity. Neither page is dated.
Other inquiries
PA reports that three other inquiries that concern Google remain open.
Sources and further reading
- Introducing auto-delete controls for your Location History and activity data
- Data Protection Commission fines Google €403 million following Inquiry into Google’s processing of location data
- Google fined for invasive location tracking after BEUC complaint
- Manage your Google Maps Timeline
- Manage your Timeline data
- Updates to Location History and new controls coming soon to Maps