Ireland DPC Levies €403M Fine on Google for 2018-2020 Location Data GDPR Breaches

The DPC inquiry opened February 2020 after BEUC member complaints filed in November 2018. It found violations of lawful processing, transparency, and storage limitation under Articles 5, 6, and 25 GDPR, plus accountability failures on Location Accuracy. The decision remains unpublished in full, with the six-month compliance order unspecified. Court confirmation is required before collection, and Google may appeal within 28 days. Google updated auto-delete defaults in 2019-2023 and shifted Timeline storage to devices. These post-inquiry changes address some transparency gaps yet leave open whether they satisfy the order. The 6.5-year timeline from complaint to fine matches patterns in prior DPC cases where enforcement trailed initial filings by years. Procurement and complaint records show repeated consumer-group pressure on location inference for advertising. Delays allow continued data retention beyond necessity, increasing exposure for users whose location profiles were built during the examined period. Independent verification of Google's claimed fixes remains limited to public announcements rather than audited logs.