Google Fined $463M Over Location Data That Could Reveal Users' Religion, Health and Sexual Orientation

Google faces one of the biggest penalties ever imposed under the EU's privacy law after Ireland's data watchdog found it had mishandled how it collected and stored users' location information.

The Data Protection Commission (DPC) announced the fine on Monday, 21 September. It penalised Google €403M ($463M, £344M) and gave the company six months to bring its location data processing into line with the law.

What the Regulator Found

At the centre of the case sit three features built into Android phones and Google accounts. Web & App Activity logs browsing and search history, Location History maps the places a user has been, and Location Accuracy sharpens an Android device's sense of where it is. The commission found that Google handled location data through them unlawfully and unfairly, held on to it longer than necessary, and was not open with people about what it was doing.

The regulator's concern was what a location trail can expose. Consumer groups that first complained argued that a log of the shops, bars, and places of worship someone visits can point to their religious beliefs, health conditions, and sexual orientation.

Deputy Commissioner Graham Doyle said such data can 'reveal a significant amount of information about an individual,' including details that are inherently private. Users, the DPC said, could have been unaware their whereabouts were being used to target them with advertising or to work out their interests. Keeping the data longer than needed made that loss of control worse.

A Complaint Six Years in the Making

The case reaches back to 2018. Consumer groups in several European countries, coordinated by the pan-European body BEUC, complained to their national regulators about how Google handled location data. Their complaints built on research by Norway's Forbrukerrådet, whose report 'Every Step You Take' accused Google of using deceptive design to keep people tracked around the clock.

Campaigners alleged the company carried on gathering location signals even when users believed they had switched tracking off. BEUC welcomed Monday's decision after a wait of more than six years.

The DPC, Google's lead supervisory authority in the EU because the firm's European headquarters sit in Dublin, opened its own-volition inquiry into Google Ireland Limited in February 2020. The decision covers 25 May 2018, the day the GDPR took effect, to 4 February 2020, and was signed off by commissioners Des Hogan, Dale Sunderland, and Niamh Sweeney.

Google's Response

Google said the case concerned historical policies. 'From 2019 onwards, we've significantly evolved our practices,' a spokesperson said, pointing to tools that let users automatically delete data, and clearer explanations of how it is used. The company is understood to be weighing an appeal on legal points it says need clarification. Under Irish procedure, any fine must be confirmed by the courts before a cent can be collected.

The penalty is the fourth largest the DPC has issued since the GDPR came into force, behind Meta's €1.2B ($1.38B, £1.03B) fine in 2023 and separate sanctions against TikTok and Instagram. The regulator has now imposed more than €4B ($4.6B, £3.4B) in total.

Only about €20M ($23M, £17M) has reached the state's coffers, with the rest tied up in appeals that can run for years. Three more inquiries into Google are at an advanced stage. As the one-stop-shop regulator for much of Big Tech in Europe, the DPC also oversees Meta, TikTok, and other firms with European bases in Ireland.

Location data underpins the targeted advertising that generates most of Google's revenue, and the six-month order requires changes to how the three features work. The DPC said it would publish its full decision in due course. Until it does, and until any appeal is heard, the effect on those settings, used by millions of Europeans, is not yet clear.