Google just got a reminder that location tracking requires more than buried privacy controls.
Ireland’s Data Protection Commission slapped Google with a €403 million ($462 million) penalty on Monday, ruling that the search giant broke European Union privacy laws by misleading users and mishandling how it tracked their physical whereabouts. The decision marks the watchdog’s fourth-largest General Data Protection Regulation fine to date.
The ruling reaches back to location practices used years ago, highlighting a recurring problem for privacy regulators: by the time enforcement catches up with a fast-moving technology platform, the products and policies under investigation may already have changed.
The findings against Google
The Irish regulator’s investigation examined Google’s conduct between May 2018 and February 2020. Watchdogs found that the company failed to process location records lawfully, fairly, and transparently across three core tools: Web & App Activity, Location History, and Android’s Location Accuracy system.
Regulators also faulted Google for retaining user location records longer than necessary and ordered the firm to bring its practices into full compliance within six months.
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” DPC Deputy Commissioner Graham Doyle said in a statement.
Doyle warned that users risked losing control over sensitive personal details: “As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.”
Google countered that the penalty targets legacy architecture rather than its current platform. “This case centers around historical policies that have since been updated,” a Google spokesperson said. “From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
The speed trap in modern privacy enforcement
The penalty exposes a structural flaw in big tech oversight: regulatory latency. The inquiry took six years from initial complaints to a final ruling. In the tech industry, a multi-year lag means companies can build entire ad ecosystems and monetize disputed behavioral patterns long before regulators hand down a punishment.
While a 403 million euro fine sounds massive, financial penalties levied years after the fact risk being treated as operational overhead rather than true deterrents. Agustín Reyna, director general of the European Consumer Organisation (BEUC), highlighted that friction: “Late enforcement can be as harmful as no enforcement at all. Consumers’ fundamental rights need to be upheld faster and better,” The Irish Times reported.
What it means for the channel
For MSPs, consultants, and other channel partners, Google’s €403 million penalty reinforces that privacy compliance cannot stop at choosing a major technology provider.
Organizations using Google services still need to understand what location and behavioral data their environments collect, how long that information is retained, and which controls are available to administrators and users. That creates an opportunity for partners offering compliance, privacy, and data governance services to help customers audit configurations and align them with GDPR and other regulatory requirements.
The six-year enforcement timeline also creates another consideration for channel providers: today’s compliant configuration may not remain sufficient as regulations, vendor practices, and enforcement decisions evolve. Regular privacy reviews can therefore become part of ongoing managed services rather than a one-time compliance exercise.
Other news: European AI firms are pushing back against U.S.-led calls to slow frontier AI development, warning that costly safety requirements could strengthen larger incumbents and make it harder for smaller competitors to keep pace.