Ireland’s Data Protection Commission (DPC) adopted a final decision on 21 September 2026 imposing administrative fines of EUR 403 million on Google Ireland Limited for breaches of the GDPR in how it processed users’ location data between 25 May 2018 and 4 February 2020. The DPC examined Web & App Activity, Location History and Location Accuracy and found infringements including unlawful or unfair processing, accountability and transparency failures, and retention longer than appropriate.

Why it matters

  • The decision orders Google to bring its processing into compliance within six months and can only be collected after Irish court confirmation; Google may appeal.
  • The case highlights regulator scrutiny of historical tech-sector data practices and the GDPR risks from location processing, retention and transparency failures.