There is a specific kind of frustration in being told a switch is off when it is not, and that is roughly what Ireland’s data protection regulator has just fined Google 403 million euros for.
The number is large. The finding underneath it is more interesting, because it is not about some exotic surveillance program. It is about two ordinary settings in a Google account, one of which almost nobody understood was collecting location at all.
The short version
- Ireland’s Data Protection Commission fined Google 403 million euros, about 459 million dollars, in a final decision dated September 21, 2026
- The inquiry covered three features: Web & App Activity, Location History and Location Accuracy
- It examined conduct between May 25, 2018, the day GDPR took effect, and February 4, 2020
- The DPC found breaches of lawfulness, fairness, transparency and accountability, and said retention beyond what was necessary made the loss of control worse
- Google has six months to bring its processing into compliance
- It is the fourth largest fine the DPC has issued since GDPR came into force
- Google’s position is that the case covers historical policies it has since changed
The setting that was not a location setting
Most people who worried about Google knowing where they were went looking for something called Location History, found it, and switched it off. That was the obvious move, and it was also incomplete.
Web & App Activity is a separate control. Its name suggests it logs searches and app usage, which it does. What was far less obvious is that the same setting could also capture location information attached to that activity. Turning off Location History did nothing to it. You had to know it existed, know it was relevant, and go find it in a different part of your account.
That gap is the heart of the DPC’s case. The regulator was not arguing that collecting location is inherently unlawful. It was arguing that people could not reasonably have understood what was happening, which under GDPR is a failure of transparency and fairness rather than a technical violation.
What each feature was doing
The three features named in the decision did different jobs, and the overlap between them is exactly what made the whole thing hard to reason about as a user.
| Feature | What people thought it did | Why the regulator looked at it |
|---|---|---|
| Location History | Kept a map of places you had been | The obvious control, but switching it off did not stop everything |
| Web & App Activity | Logged searches and app usage | Could also capture location, in a place nobody was looking for it |
| Location Accuracy | Made the blue dot on the map more precise | Sharpened the signal feeding the other two |
Put together, the DPC’s position is that a person could switch off the setting with “location” in the name and still be generating a location record, and that record could then be used to infer their interests and shape the ads they saw. Google’s advertising reaches across a very large share of the web plus YouTube, so the inference does not stay in one place.
This is the same structural problem that keeps showing up in different clothes. When Apple put ads into Maps with no way to turn them off, the complaint was not that the ads existed. It was that the control people expected to find was simply not there. The pattern repeats because the useful setting and the profitable setting are rarely the same setting.
Where 403 million euros sits
Large privacy fines have a way of blurring together, so it helps to see the number against its neighbors. This is the fourth largest penalty the Irish DPC has issued since GDPR came into force, and the ranking says something about what regulators treat as serious.
Google and Instagram are separated by two million euros and four years, which is a reminder that these numbers are calculated, not chosen for effect. GDPR caps administrative fines at four percent of global annual turnover, and against Alphabet’s revenue, 403 million euros is a long way below the ceiling.
Google’s answer, and why it is partly fair
Google’s response has been consistent: the case centers on historical policies that have since been updated, and its practices have changed significantly since 2019. That is not spin, or at least not only spin.
The company did make real changes while this inquiry ground on. Timeline data moved toward on-device storage rather than sitting on Google’s servers. The default auto-delete window for location data dropped from 18 months to three. The account controls got clearer labels. Anyone setting up an Android phone in 2026 gets a meaningfully different experience from someone setting one up in 2018.
The obvious counterpoint is that those changes arrived under regulatory pressure, and that the DPC still issued a corrective order alongside the fine. If everything had genuinely been fixed, there would be nothing left to order. Six months is the deadline, and the specifics of what Google must change will matter more to European users than the headline figure does.
What this means if you are not in Europe
The fine is European. The settings are not.
The DPC acts as lead supervisory authority for Google across the European Economic Area, which is 30 countries, and its decisions bind Google’s conduct there. But Web & App Activity, Location History and Location Accuracy are the same features in the same account menus whether you are in Dublin, Denver or Delhi. What changes outside the EEA is that nobody is issuing orders about them on your behalf.
That is the practical takeaway. A regulator spent six years establishing that these controls were confusing, and the remedy that arrives in your account is the same remedy you could apply yourself this afternoon.
How to actually switch location tracking off
Three settings, not one
- Timeline, formerly Location History. Go to your Google Account, open Data & privacy, and find Timeline. Turn it off and use the delete option for what is already stored, because switching off does not erase history
- Web & App Activity. In the same Data & privacy section. This is the one that catches people out, so check the sub-option that includes your activity on Google services and the associated location information
- Search services history and Location Accuracy. On Android, Location Accuracy lives in the phone’s location settings rather than the account. Turning it off degrades navigation precision, which is the honest trade
- Set auto-delete while you are there. If you want the features but not the archive, three months is the tightest window Google offers and it applies going forward
Expect maps, traffic predictions and recommendations to get worse. That is the point of the trade, and it is a real one rather than a bluff.
The part worth sitting with
Six years is a long time. The conduct the DPC examined ended in February 2020, which means the decision lands on a version of Google that no longer quite exists. By the time the corrective order takes effect, the interesting privacy questions will have moved to whatever the current systems are doing.
That lag is structural. Investigations of this size involve draft decisions, objections from other European authorities, and the dispute resolution machinery that sits above them all. It produces careful decisions, slowly, about things that happened a while ago. Meanwhile the collection surface keeps expanding, from phones to cars to roadside cameras that read your phone rather than your plate, and each new layer will need its own six years.
It is also worth noticing what the fine is not about. Nobody alleged Google was selling your location to strangers. The finding is narrower and, in a way, more familiar: the company collected more than people understood, kept it longer than it needed to, and used it to decide what to show you. That is not a scandal so much as a business model, which is why the same shape keeps reappearing. The same logic is why OpenAI now runs an advertising cookie across more than a thousand websites under an analytics label. Measurement follows advertising everywhere it goes.
What to take from this
- Location History was never the only switch. Web & App Activity is the one that surprised people, and it is still where you should look first
- The violation was about comprehension, not collection. GDPR asks whether a reasonable person could understand what was happening, and the DPC decided they could not
- Retention made it worse. Keeping data longer than necessary was explicitly cited as aggravating the loss of control
- A corrective order came with the money. Six months, and that part will change what European accounts actually do
- The settings are global even though the fine is not. The cleanup is available to you regardless of where you live
The uncomfortable arithmetic is that 403 million euros is a serious number to almost everyone and a manageable one to Alphabet. Fines at this scale work as precedent rather than as punishment. What actually changes behavior is the order attached to them, and the fact that the next inquiry starts from a regulator that has already won this argument once.
Sources and further reading
- Data Protection Commission: DPC fines Google 403 million euros following inquiry into location data
- The Irish Times: Irish data protection watchdog fines Google 403 million euros over GDPR breaches
- The Hacker News: Google fined 403 million euros over GDPR violations tied to location data
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
