Google has been fined more than €400m over the way it processed users' location data, following complaints that the company had manipulated users into agreeing to be constantly tracked on their mobile phones.
The fine, of €403m, was imposed by Ireland's Data Protection Commission after complaints from seven European consumer organisations, which argued that undue use of location data can amount to a breach of privacy.
The inquiry was prompted by research published in 2018 by the Norwegian consumer agency, which suggested that location data could reveal details such as religious beliefs, by tracking places of worship, political leanings, by knowing that a user had attended demonstrations, health conditions, if a user had gone to hospital, and sexual orientation, if they had visited certain bars.
The commission opened its inquiry six years ago and set out to establish whether Google had a valid legal basis for its use of location data. It examined "web and app activity", "location history" and "location accuracy" between 25 May 2018 and 4 February 2020.
It found that Google users could have been unaware that their location was being used to influence them with advertisements or to gather details about their health and interests.
"Location data can bring both benefits and harms to individuals," said Graham Doyle, a deputy commissioner at the DPC. "It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private." He added that the retention of users' location data for longer than necessary had aggravated that loss of control.
The commission ordered Google to bring its processing into compliance with the EU's general data protection regulation within six months.
It is the fourth-largest fine imposed by the Irish regulator, which has EU-wide responsibility for the US technology companies with European headquarters in Ireland. It has previously fined Meta €1.2bn, TikTok €530m and Instagram €405m.
Google said: "This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."
Agustín Reyna, director general of the European Consumer Organisation, welcomed the ruling but said "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement", arguing that "late enforcement can be as harmful as no enforcement at all". Three further large-scale statutory inquiries concerning Google remain open, all of them described as at an advanced stage.
Two periods in this case are worth setting side by side. The conduct examined ran from 25 May 2018 to 4 February 2020, a little over 20 months. The examination of it ran for six years. That is roughly three and a half years of inquiry for every year of tracking.
At that ratio the regulator does not catch up; it recedes at a fixed rate. Any given stretch of processing takes substantially longer to assess than it took to occur, so the assessment can only ever conclude later than its subject matter, and by a margin that widens the longer the subject matter runs.
This is what gives Google's response its unusual strength. The policies are historical. They were bound to be. An inquiry that takes six years converts whatever it examines into history as a matter of arithmetic, and the defence is therefore written on the regulator's own timetable rather than the company's.
Three further inquiries into the company are open and at an advanced stage. On the rate established here, their subject matter is already in the past, and is getting further into it at a rate of one year per year.
The Department of Unnecessary Research notes that by the time those three report, their subject matter will also be historical, and has asked the commission to clarify whether this constitutes a defence or a schedule.