Irish regulator fines Google €403m over location data. Six months to change it

Ireland’s Data Protection Commission fined Google Ireland €403 million on 21 September 2026. The case reaches back to data collected between 25 May 2018 and 4 February 2020.

Three Google settings sit at the centre of the case

The inquiry covered Web & App Activity, Location History and Location Accuracy. The first two store where a user has been. The third helps a phone work out where it is. The regulator said Google had no lawful and fair basis for the first two. It also said Google could not show that Location Accuracy met the rules.

The order also names unclear notices and long storage

The decision lists four faults. Processing was unlawful and unfair. The notices told users too little. The data stayed in Google’s systems longer than it needed to. And Google could not prove it had checked one setting against the law. Three commissioners signed the decision: Des Hogan, Dale Sunderland and Niamh Sweeney. Deputy Commissioner Graham Doyle said location data can “reveal significant information about an individual” (Data Protection Commission, English).

Google’s six-month clock reaches geo targeting and store visits

Location signals sit under geo targeting, store visit reports and radius bidding. Google has already reworked other European products this year. It dropped free product listings across Europe to meet the DMA. In the same weeks it let retailers share shopper audiences with brands. Both rest on what Google may keep, and for how long.

The six months start on 21 September 2026. By late March 2027 the three settings have to meet the law, and the Irish office will check. That deadline is the part to hold Google to, not the size of the cheque.