Google has been fined €403 million (approx $463 million) by Ireland’s Data Protection Commission (DPC).
The penalty relates to how the company processed users’ location data, following complaints that Google manipulated users into agreeing to be constantly tracked on their phones.
The fine follows a six-year investigation.
It was triggered by complaints from seven European consumer organisations, including Norway’s Forbrukerrådet, who argued that excessive use of location data can breach users’ privacy.
The DPC’s inquiry traces back to 2018 research from Forbrukerrådet, which first raised the alarm on Google’s location tracking practices.
That research suggested location data could reveal sensitive details such as religious beliefs, political leanings, health conditions and sexual orientation, simply by tracking where a person goes.
How Google mishandled users’ location data
The DPC examined Google’s “Web & App Activity,” “Location History” and “Location Accuracy” features.
The review covered the period from May 25, 2018, when GDPR came into force, to February 4, 2020.
Investigators concluded Google had breached the GDPR on multiple fronts.
The company failed to process location data lawfully and fairly through Web & App Activity and Location History, and failed to demonstrate compliant, transparent practices for Location Accuracy.
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” said Graham Doyle, deputy commissioner at the DPC.
“It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.”
The DPC said Google users could have been unaware their location was being used to influence them with ads or to infer details about their health and interests.
Retaining location data longer than necessary, the regulator added, made that loss of control worse.
Consumer groups say enforcement came too slowly
The European Consumer Organisation (BEUC) based its original complaint on Forbrukerrådet research, which claimed Google used “various tricks” to keep location history and web and app activity switched on.
Finn Myrstad, digital policy director at the Norwegian Consumer Council, called the ruling “an important milestone,” saying people must be able to understand what they’re agreeing to without being deceived or manipulated.
BEUC director general Agustín Reyna welcomed the decision but criticized the pace of enforcement, saying “the time needed to come to this conclusion is disproportionate with the seriousness of the infringement,” and warning that “late enforcement can be as harmful as no enforcement at all.”
The DPC has ordered Google to bring its data processing into compliance with GDPR within six months.
The €403 million (approx $463 million) fine ranks as the fourth-largest the Irish regulator has ever issued, behind its €1.2 billion (approx $1.38 billion) fine against Meta, €530 million (approx $610 million) against TikTok, and €405 million (approx $466 million) against Instagram.
The post Google fined $463M by Irish regulator over location data tracking appeared first on Invezz
