The challenge wasn't that Google collected location data. It's that users couldn't understand what was happening to it.
When Ireland's Data Protection Commission opened its inquiry in February 2020, it focused on three Google features: web and app activity, location history, and location accuracy. The investigation examined data processing practices from May 2018 (when the General Data Protection Regulation took effect) through February 2020. The result: a €403 million fine and a six-month deadline to fix fundamental transparency failures.
The Challenge
Google faced scrutiny over whether users genuinely understood how their location data was being processed. The DPC's investigation centered on two critical GDPR principles: lawfulness and fairness of processing, and transparency obligations under Articles 5 and 12-14.
The core issue wasn't technical capability. Google's infrastructure could track, store, and analyze location data at scale. The problem was disclosure. According to the DPC, "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests."
Location data carries unique sensitivity. As DPC Deputy Commissioner Graham Doyle noted, it can "by itself or in conjunction with other information" reveal where someone lives, works, worships, or seeks medical care. This isn't just metadata. It's a continuous record of physical presence that, when retained beyond necessity, creates compounding privacy risk.
The Environment and Constraints
Google operated under several competing pressures during the investigation period:
Regulatory complexity: The GDPR requires controllers to demonstrate compliance through documentation, not just good intentions. Articles 24 and 25 mandate accountability measures and data protection by design. Google needed to prove it had implemented technical and organizational measures proportionate to processing risk.
User experience trade-offs: Location services power core functionality. Turn-by-turn navigation, local search results, and contextual recommendations all depend on precise location access. Disabling these features entirely would degrade product value. The question became: how do you make processing transparent without overwhelming users with consent dialogs?
Data retention practices: Google's web and app activity feature stored location data to improve service personalization. But the DPC found this retention extended beyond what was "necessary" under Article 5(1)(c)'s storage limitation principle. Every additional day of retention without clear justification increased GDPR exposure.
Cross-service data flows: Location data collected through one feature (like location accuracy) could inform processing in another (like ad targeting). These connections weren't always obvious to users reviewing individual privacy settings.
The Approach Taken
Based on the DPC's findings, Google's approach during the investigation period fell short in three areas:
Transparency deficits: Users couldn't easily determine how location data from different features was being combined or retained. The DPC concluded Google violated transparency requirements, suggesting privacy notices didn't adequately explain processing purposes, legal bases, or retention periods.
Inadequate accountability mechanisms: The regulator found Google failed to demonstrate sufficient accountability measures. This likely means documentation gaps around data protection impact assessments, records of processing activities, or evidence that privacy considerations influenced product design decisions.
Excessive retention: Storing location history "for longer than necessary" violated Data Minimisation principles. Google apparently couldn't justify why historical location records needed to persist beyond their original collection purpose.
These aren't small documentation errors. They represent systematic failures to implement GDPR's core requirements across a major product line.
Results and Metrics
The DPC imposed a €403 million administrative fine. This is the first penalty the Irish regulator has levied against Google, though it has fined Meta and TikTok hundreds of millions across multiple decisions.
Beyond the financial penalty, Google must bring its location data processing into compliance within six months. This deadline creates operational urgency. Google needs to:
- Revise privacy notices to meet Articles 13-14 transparency standards
- Implement or document accountability measures under Article 24
- Adjust retention schedules to satisfy storage limitation requirements
- Potentially redesign how location features interact with each other
The six-month corrective order matters more than the fine. It forces architectural changes that affect millions of users across the European Economic Area.
What They Would Do Differently
While Google hasn't publicly detailed its remediation plan, the DPC's findings point to clear gaps:
Front-load transparency: Privacy notices should explain location processing before users enable features, not buried in settings. This means surfacing information about data retention, cross-service uses, and inference capabilities (like deriving interests from location patterns) at the point of consent.
Document necessity: For every location data retention period, maintain written justification tied to specific processing purposes. If you can't articulate why 18 months of location history is necessary versus 6 months, you can't defend the longer period under Article 5(1)(c).
Conduct rigorous DPIAs: Data protection impact assessments aren't optional for high-risk processing. Location tracking at scale qualifies. A thorough DPIA would have identified transparency risks and prompted mitigation measures before the DPC inquiry began.
Implement granular controls: Users should be able to enable location services for navigation without automatically enabling location-based ad targeting. Bundling unrelated processing purposes into a single consent mechanism violates Article 7's requirement that consent be "freely given."
Takeaways for Your Team
If you're processing location data, this case exposes four vulnerabilities:
Audit your transparency stack: Pull up your privacy notices for location-enabled features. Can a non-technical user understand what data you collect, how long you keep it, and what you do with it? If your legal team wrote the notice without product manager input, it probably doesn't explain actual data flows.
Map cross-feature data use: Location data collected for one purpose often feeds other systems. Document these flows explicitly. Your Article 30 record of processing activities should show how location data moves between authentication, analytics, personalization, and advertising systems.
Justify retention periods with evidence: "We might need it someday" isn't a legal basis. For each data category, document the business or technical reason for your retention period. If you're keeping location history for 24 months, show why 12 months wouldn't suffice.
Test your accountability mechanisms: The GDPR requires you to demonstrate compliance, not just claim it. This means maintaining current data protection impact assessments, conducting regular privacy reviews, and documenting design decisions that affect user privacy. If a regulator asks how you implemented data protection by design, you should be able to produce meeting notes, architecture diagrams, and decision logs.
The €403 million fine reflects more than location tracking. It's a penalty for opacity. When users can't understand what's happening to their data, you're not just violating transparency rules. You're undermining the foundational principle that individuals should control their personal information.
Your compliance program needs to answer one question clearly: if a regulator examined your data processing practices for two years, what would they find?
