TL;DR
- Ireland's Data Protection Commission fined Google €403 million on 21 September 2026 over location data in Web & App Activity, Location History and Location Accuracy.
- The inquiry covered 25 May 2018 to 4 February 2020 and found four GDPR breaches: lawfulness and fairness, accountability, transparency and retention.
- Deputy Commissioner Graham Doyle said users could have been unaware their location was used to influence them with ads or infer their interests.
- Google must bring processing into compliance within six months; the full decision and the split of the fine have not yet been published.
Ireland's Data Protection Commission (DPC) fined Google €403 million on 21 September 2026 and ordered it to bring its processing of location data into line with the GDPR within six months. The decision covers three Google features, Web & App Activity, Location History and Location Accuracy, as they operated between 25 May 2018 and 4 February 2020.
The case is European, and it concerns a period more than six years ago. It is still worth reading closely from Thailand, because the regulator tied its reasoning directly to advertising: people "could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests." That is the same link between location, interest inference and ad targeting that Thailand's PDPA also regulates.
What the DPC decided
According to the DPC's announcement, the decision was made by the three Commissioners for Data Protection, Dr Des Hogan, Dale Sunderland and Niamh Sweeney. It closes an own-volition inquiry the DPC opened in February 2020, acting as lead supervisory authority for Google Ireland Limited, after complaints from several European consumer organisations including BEUC.
The DPC found that Google infringed the GDPR on four counts:
- the lawfulness and fairness of its processing of location data in Web & App Activity and Location History;
- its accountability obligations, by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle for Location Accuracy;
- its transparency obligations for all three features;
- its retention of location data in Web & App Activity and Location History.
The DPC imposed administrative fines totalling €403 million and ordered Google to bring its processing into compliance within six months. It said it will publish the full decision "in due course".
The findings, feature by feature
The four findings do not fall evenly across the three features. The table sets out which finding applies where, as listed in the DPC statement.
| Feature | What the DPC found |
|---|---|
| Web & App Activity | Lawfulness and fairness, transparency, retention |
| Location History | Lawfulness and fairness, transparency, retention |
| Location Accuracy | Accountability (could not demonstrate compliance), transparency |
The Location Accuracy finding is narrower. The DPC did not make a positive finding that the processing was unlawful. It found that Google could not demonstrate that it was lawful, fair and transparent, which is a breach of the GDPR's accountability rule in its own right, because that rule puts the burden of proof on the company.
What each feature does
The DPC's background notes describe the three features in plain terms.
Web & App Activity is a Google Account setting, available only to account holders. When it is on, Google uses it to process information about the user's activity on Google services, including sites and apps. That can include browsing history, search history and location data.
Location History is opt-in. Once switched on, it tracks the user's location while they carry compatible mobile devices and infers place visits, activities and the paths between them. It powers a Timeline feature that shows a private map in Google Maps. The DPC noted that it saves that map "even when the user is not using a Google service."
Location Accuracy is part of Android rather than a Google Account setting. It lets a device work out its location more precisely than GPS alone. The DPC noted that it is available to Android users whether or not they hold a Google Account, which means this finding reaches people outside the account-holder population.
Why the regulator mentioned ads
Deputy Commissioner Graham Doyle's statement is the part most relevant to marketers. He said location data "can reveal a significant amount of information about an individual, including information that is inherently private," and that because of Google's failures, people could have been unaware their location was used "to, for example, influence them with ads or to infer their interests, and could lose control over their personal data." He added that keeping location data "for longer than necessary aggravated this loss of control."
Two points follow. The regulator treats interest inference from location as a use people must be told about clearly. It also treats long retention as making the harm worse, not as a neutral storage choice. The statement does not name any Google advertising product, and it does not say the decision changes how Google's ad targeting or measurement works today.
Doyle also gave a working definition that is broader than GPS coordinates. Location data, he said, is personal data processed by way of location tracking, including data from which "by itself or in conjunction with other information an individual's location can be inferred." For marketers, that wording matters: signals that only reveal location when combined with other data, such as identifiers that point to a place only once they are matched against other records, fall inside the same definition as a precise GPS fix.
What Google said
The DPC statement does not include a response from Google. PPC Land, citing the Irish Examiner and Yahoo Finance, reported that a Google spokesperson said the case concerns historical policies that have since been updated, and that the company substantially changed its practices from 2019 onwards, including auto-delete settings for account data and on-device storage of Timeline data. Google has not said publicly whether it will appeal.
Part of the inquiry period, 2019 to February 2020, overlaps with the changes Google describes. The DPC statement does not say whether it assessed the current versions of the three features, or what compliance within six months will require of products Google says it has already rebuilt. The full decision is the document most likely to answer that.
What the announcement leaves open
- How the €403 million is split across the four infringements. The statement gives only the total.
- Which GDPR articles the decision cites.
- Whether the six months run from 21 September 2026 or from formal notification.
- Whether other EU supervisory authorities raised objections during the cooperation procedure. The DPC thanked its peer authorities for their cooperation but did not say more.
What this means for Thai marketers
The GDPR does not apply to a Thai business serving only Thai customers, and the fine does not change anything in Google Ads or Google Analytics accounts in Thailand. The reasoning still carries over, because Thailand's Personal Data Protection Act is built on similar principles: a lawful basis for processing, clear notice to the data subject, and keeping data no longer than necessary.
Brands that collect location data themselves, through an app, a loyalty programme, store check-ins or location permissions on a website, can use the decision as a checklist:
- Can you show, in writing, the lawful basis for each location use, including any use for ad targeting or interest segments? The Location Accuracy finding was about failing to demonstrate compliance, not only about what was done.
- Does your privacy notice say plainly that location may be used for advertising or to infer interests? The DPC's concern was that users "could have been unaware".
- How long do you keep raw location records, and is there a documented reason for that period? Retention was one of the four findings.
- If you send location-derived audiences or conversions to ad platforms, are those flows covered by your consent records?
Location-based targeting and store-visit measurement remain available in Google's ad products in Thailand. The decision is a reminder that the data behind them sits under privacy law, and that regulators look at how clearly people were told. A review of what your GA4 and tracking setup collects, and how that data feeds Google Ads campaigns, is a sensible place to start.
Frequently asked questions
Why was Google fined €403 million?
Ireland's DPC found that Google broke the GDPR in how three features, Web & App Activity, Location History and Location Accuracy, processed, explained and retained location data between May 2018 and February 2020. It announced the fine on 21 September 2026.
Does this fine affect advertisers in Thailand?
Not directly. The decision applies to Google Ireland under EU law and does not change Google Ads or Analytics features in Thailand. The principles it enforces, clear notice and limited retention, overlap with Thailand's PDPA.
What does Google have to change?
The DPC ordered Google to bring its processing into compliance within six months but did not publish the specific changes. It said the full decision will be issued in due course.
Will Google appeal the decision?
Google has not said publicly. PPC Land, citing the Irish Examiner, reported a spokesperson saying the case concerns historical policies that have since been updated.
Did the DPC say location data cannot be used for ads?
No. The DPC said people could have been unaware their location was used to influence them with ads or infer their interests. The problem it identified was lawfulness, transparency and retention, not advertising use as such.
The €403 million headline will get the attention, but the more useful part for marketers is the regulator's own sentence: location used for ads and interest inference has to be explained clearly and kept only as long as needed. The same test applies to any business collecting location data, in Europe or in Thailand.
