What happened
The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness, transparency, accountability and data retention in Google's location‑data features. Google was ordered to bring its processing into compliance within six months.
Penalty
administrative fines totalling 403 000 000 EUR
Why it matters for trust and compliance
- Its status is decided. The case has an outcome that others may cite.
- The fine underscores strict enforcement of GDPR obligations for large tech firms handling location data.
- Takes effect September 21, 2026.
- Penalty: administrative fines totalling 403 000 000 EUR.
- It relates to GDPR. The regulations library explains what that law requires.
Who is affected
technology controller Google Ireland Limited
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Revisit retention schedules and data minimisation for the data involved.
- Inventory where this data is shared or sold and whether opt-outs are honoured.
- Inventory AI or automated decision systems in scope and their assessments.