• by Laurie Sullivan , September 21, 2026

Google has been fined €403m (about $462.7 million) by the The Republic of Ireland Data Protection Commission (DPC).

The DPC announced the fine Monday, and attributed it to the way the Alphabet company handled location data. 

An investigation triggered by the European consumers rights organization, the DPC said Google had breached EU General Data Protection Regulation (GDPR) standards between May 2018 and February 2020.

The investigation was based on processing data in three Google features: Web & App Activity, Location History and Location Accuracy.

The decision was made by the Commissioners for Data Protection Des Hogan, Dale Sunderland and Niamh Sweeney.

The three Commissioners also found that Google had infringed the GDPR by retaining possession of location data in Web & App Activity and Location History.

Location data is any type of data that can be used to infer a person's whereabouts and reveals a significant amount of information about an individual.

The penalty was associated with "historical policies" for the management of location data that has since been revised, a Google spokesperson told Reuters, which reported it as the fourth-largest of the more than €4 billion in total levied by the DPC since it became the lead EU regulator for most big U.S. technology firms.

The largest penalty remains Meta's €1.2 billion fine in 2023, with TikTok's €530 million fine and a €405 million fee for Instagram rounding out the top three.

“The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples' location data,” said Agustín Reyna, director general of BEUC (Bureau Europeen des Unions de Consommateurs), which investigates EU decisions and developments that are likely to affect consumers.

“However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement. Late enforcement can be as harmful as no enforcement at all. Consumers’ fundamental rights need to be upheld faster and better," Reyna added.

The DPC has three other large-scale inquiries open that concern Google, which are all at an advanced stage.

Opened in September 2024, this inquiry pertains to the way Google processes data from artificial intelligence (AI) platforms, and focuses on whether Google complied with GDPR requirements -- specifically the obligation to conduct a Data Protection Impact Assessment (DPIA), according to one report.