Ireland’s Data Protection Commission just closed the book on a six-year investigation, and the bill came to €403 million. On Monday, September 21, regulators announced that Google had breached the EU’s core privacy law, the GDPR, through how it handled location data across three specific features between 2018 and 2020.
What the Investigation Actually Found
The DPC’s inquiry, launched in February 2020 following complaints from several European consumer rights organizations including BEUC, examined three specific Google features, Web & App Activity, a setting that tracks browsing and search history, Location History, a service mapping where users have physically been with their phones, and Location Accuracy, a feature built into Android itself.
Regulators concluded Google did not process location data lawfully or fairly in either Web & App Activity or Location History, and separately found the company failed to be lawful, fair, or transparent in how it processed personal data through the Android Location Accuracy feature. The DPC has ordered Google to bring its data processing practices into full compliance within six months of the decision.
Ireland serves as Google’s lead EU regulator because the company’s European headquarters sits in Dublin, giving the DPC jurisdiction over enforcement actions against the company across all 27 EU member states.
Google’s Response
Google has pushed back on the framing of the ruling, telling reporters the case concerns historical practices from 2018 to 2020 that the company says have since been changed. That’s a defense Google has leaned on before in similar cases, arguing that regulatory findings often lag years behind current product practices by the time an investigation actually concludes.
This Is Now the Third Major Fine in Two Months
Here’s what makes Monday’s penalty land harder than a standalone story. This is Google’s third major EU fine in as many months. Back in July, the company was hit with a combined nearly $1 billion in separate penalties, €460 million for allegedly favoring its own services within Search results, and €430 million for restricting how app developers could operate on Google Play. Google also lost an appeal that same period against a long-standing €4.1 billion Android antitrust fine originally issued back in 2018.
Stacked together, that’s roughly €1.7 billion in EU fines and lost appeals hitting Google inside a single summer, a pace of regulatory action that stands out even for a company with a long history of run-ins with European regulators.
Where This Ranks Historically
Despite the size of the number, €403 million is not actually the largest GDPR penalty ever issued, it ranks as the fourth-largest sanction under the regulation since GDPR took effect in 2018, trailing only Ireland’s own record-setting cases against Meta. That context matters, this isn’t Europe’s biggest privacy fine ever, but it’s a substantial one, and it adds to a fine total against Google that’s now climbed well into the billions across the company’s history with EU regulators.
Why the Timing Feels Pointed
Some observers have noted the fine lands at an awkward moment for Google specifically around transparency. The company has separately faced scrutiny this year over how quickly, or slowly, it discloses AI-related security incidents, including a reported multi-month delay in revealing a Gemini AI security breach earlier this year. Regulators on both sides of the Atlantic appear to be converging on a similar underlying complaint, that Google’s internal transparency and disclosure practices consistently lag behind what the law, and users, reasonably expect, whether the issue is location tracking or AI system security.
The Bottom Line
Google’s €403 million fine closes out a six-year regulatory process, but it lands in the middle of an unusually active stretch of EU enforcement against the company, and it’s unlikely to be the last word on how Brussels and Dublin approach Google’s data practices going forward. With roughly €1.7 billion in fines and failed appeals piling up over just the past two months, the pattern suggests European regulators are treating Google’s compliance history as a genuinely ongoing concern rather than a series of isolated incidents.
You can read the full decision directly from Ireland’s Data Protection Commission.
For more on how AI companies are being held to account this year, check out our coverage of Anthropic’s threat intelligence report on Claude misuse.
