Google fined £345m for mishandling users’ location data
Ireland’s data protection regulator found Google failed to properly inform users how their location was tracked and used to target them with ads, resulting in the regulator’s fourth-largest GDPR fine.
Google has been fined more than €403 million (£345 million) by Ireland’s Data Protection Commission (DPC) after a six-year investigation found the company breached GDPR rules over how it collected and used users’ location data.
The DPC launched its inquiry into Google Ireland after complaints from consumer rights organisations across Europe, examining how the company processed web and app activity, location history and location accuracy data between 25 May 2018 and 4 February 2020.
It found that users could have been unaware their location was being used to influence the ads they saw or to infer their interests.
Graham Doyle, deputy commissioner at the DPC, said:
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred.”
He added: “Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.”
Sign up to Consumer Voice to stay updated on major claims and investigations involving Google, including Google Play and Google Search, as well as other consumer claims and rights issues.
What Google did wrong with users’ location data
The DPC found that Google’s processing of location data fell short of GDPR’s requirements for lawful, fair and transparent handling of personal data, and that Google had also failed to meet its accountability obligations under the regulation.
Doyle said the GDPR “provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.”
As a result of Google’s failures in this regard, he said, “individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.” He added that the retention of users’ location data for longer than necessary “aggravated this loss of control”.
The €403 million (£345 million) fine is the fourth largest the DPC has issued since GDPR came into force. Google has been ordered to bring its data processing practices into compliance within six months.
Google is expected to appeal the ruling
A Google spokesperson said the case “centres around historical policies that have since been updated,” pointing to changes introduced from 2019 onwards. These include letting users set their account to automatically delete location data on a rolling three, 18 or 36-month basis, new settings to turn off personalised ads or manage how location data is used for advertising, and storing “Timeline” location history directly on users’ own devices rather than centrally.
Google also said it no longer stores a user’s precise location in Web & App Activity when they make a search, instead saving an “estimated general area.” Google is expected to appeal the ruling over legal issues it says require clarification beyond this case.
The DPC has three other large-scale inquiries into Google currently open, all of which are said to be at an advanced stage.
Google Play trial starts 6 October
The fine comes as Google faces a series of separate regulatory investigations and consumer legal claims over different parts of its business.
These include major UK claims involving both Google Play and Google Search, where consumers could ultimately be entitled to compensation if these claims succeed.
We recently reported on the £260m Google Play Store developer settlement, while the separate consumer case over charges through Google Play begins on 6 October.
Sign up for Consumer Voice alerts to follow the Google Play trial and other major consumer claims and rights issues.
Get our alerts
Sign up for Consumer Voice alerts. Once you’ve signed up, we’ll take you straight to the official Google Play Store claim website, where you can register directly for updates from the claim team.
