Irish Data Protection Commission fines Google €403 million for GDPR violations over location data

What happened

The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness, transparency, accountability and data retention in Google's location‑data features. Google was ordered to bring its processing into compliance within six months.

Penalty

administrative fines totalling 403 000 000 EUR

Why it matters for trust and compliance

• Its status is decided. The case has an outcome that others may cite.
• The fine underscores strict enforcement of GDPR obligations for large tech firms handling location data.
• Takes effect September 21, 2026.
• Penalty: administrative fines totalling 403 000 000 EUR.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Revisit retention schedules and data minimisation for the data involved.
3. Inventory where this data is shared or sold and whether opt-outs are honoured.
4. Inventory AI or automated decision systems in scope and their assessments.