Google’s €403m fine leaves order hidden

Ireland's Data Protection Commission fined Google €403 million on 21 September for how three location features processed personal data across the European Economic Area (Irish DPC, Euronews). The fine is the headline. The DPC has not published the reasoned decision, the fine calculation, the precise legal failures or the compliance order. Almost eight years after consumer groups complained, the public still cannot judge whether the penalty and remedy match the violations.

What the DPC announced — and what it has not published

The inquiry examined conduct between May 2018 and February 2020 across three Google features: Web & App Activity, Location History and Android's Location Accuracy. The important interaction between them is that a user who turned off Location History could still have location-related information saved through Web & App Activity. Norway's Consumer Council documented that gap in a 2018 report. The regulatory question was whether users could understand the combined effect of separate controls governing where they went, when and how often.

The findings differed by feature. Web & App Activity and Location History drew violations on lawfulness, fairness and transparency. The DPC's announcement lists those statutory findings but does not reveal which legal basis Google asserted or why it failed (Irish DPC). For Location Accuracy, the announced finding was that Google failed to demonstrate compliance, an accountability violation. The unpublished decision may clarify what the DPC concluded about the processing itself. Only the first two features were found to retain data excessively.

Most coverage collapsed these distinctions into "Google tracked users for ads." The findings extend beyond advertising. How the €403 million was divided among the infringements, and what each feature contributed, remains unknown. The DPC says the full decision will follow "in due course" (Irish DPC).

Eight years from complaint to fine

Consumer organisations in eight countries filed coordinated complaints in November 2018 through BEUC, the European consumer umbrella body (BEUC, Forbrukerrådet). The DPC opened its own inquiry in February 2020 and announced the result in September 2026. The Dutch Consumentenbond celebrated the outcome but stressed that consumers waited almost eight years (Consumentenbond). BEUC argued that enforcement arriving after products have changed loses much of its preventive value (BEUC).

The GDPR's one-stop-shop mechanism (where one national regulator leads cases for companies with cross-border operations) concentrated control of this case in Dublin, because Google's relevant European establishment is there (GDPR, EUR-Lex). Other regulators could comment or object, but the DPC ran the investigation. It thanked peer authorities for "cooperation and assistance" without naming them or disclosing whether any objected. No corresponding ruling appeared in the European Data Protection Board's register of binding dispute-resolution decisions.

Google's defence and the missing order

Google argues this ruling examines historical practices it has already reformed. The company introduced automatic-deletion controls in 2019, set protective defaults for new users in 2020, and later moved Maps Timeline data towards on-device storage (BleepingComputer). Those redesigns may reduce what Google still needs to change. They do not retroactively legalise the 2018–2020 processing, and company descriptions of reforms are not independent proof of compliance.

The six-month compliance order could matter more than the fine. But the DPC has not published what Google must change: whether historical data must be deleted, how compliance will be tested, or when the clock starts. The fine itself must be confirmed by an Irish court before payment, and Google can appeal (EUobserver).

The one-stop-shop gave this ruling reach: one decision governing Google's location processing across the EEA. It did not prevent an almost eight-year wait. Until the DPC publishes its reasoning and order, the ruling establishes violations but does not let outsiders judge whether the penalty and remedy match them. The unpublished order will show whether Google must delete data, redesign its controls or merely document reforms already made.