TEHNOLOGIE
Google's €403 million fine — why the six-month compliance order matters more than the sum
Ireland's Data Protection Commission fined Google €403 million on 21 September 2026 and gave it six months to bring three location features into compliance.
The sum is the fourth largest the Irish authority has ever imposed, but it is not the part that binds. The compliance order runs from the day of the decision and expires in March 2027, whatever happens to the fine. The falsifiable thesis of this article: the fine is a cost, the order is a product constraint, and the two can be settled independently — Google can pay and appeal without changing anything in its apps, or it can change its consent flows without the sum dropping by a single euro.
What the Irish authority decided, point by point
The statement published on 21 September 2026 by the Data Protection Commission (DPC) names exactly what was investigated. The inquiry covered Google's processing of location data in three features — "Web & App Activity", "Location History" and "Location Accuracy" — between 25 May 2018 and 4 February 2020. The first date is the day the GDPR became applicable; the second is the day the DPC opened the inquiry.
There are four findings, not one. Processing was not lawful and fair in "Web & App Activity" and "Location History"; for "Location Accuracy", the company could not demonstrate compliance with the lawfulness, fairness and transparency principle; transparency obligations were infringed across all three features; and location data in the first two was retained longer than necessary.
The operative part has two components. The first is the fine of €403 million, put at $462 million by The Record and at $463 million by BleepingComputer. The second is the order to bring processing into compliance within six months.
What the statement does not contain matters just as much. The DPC does not publish the legal classification — the GDPR articles relied on — and announces that it will issue the full decision "in due course". Until then, the wording used ("lawfulness and fairness", "transparency", "accountability", excessive retention) maps onto the principles in Article 5 GDPR, but that correspondence is this article's inference, not a statement by the authority.
The actors: who decided, who complained, who pays
The decision was not taken by an abstract institution but by three people named in the statement: Dr Des Hogan, Dale Sunderland and Niamh Sweeney, Commissioners for Data Protection. The authority's public voice was Deputy Commissioner Graham Doyle, quoted by every source in this article.
Doyle framed the harm in terms of control, not figures. According to Euronews, he said that as a result of Google's failures, "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data", and that retaining the data longer than necessary "aggravated this loss of control".
At the other end stand the complainants. The inquiry was opened on the authority's own initiative, following complaints lodged by European consumer rights organisations, among them BEUC — the European consumer umbrella organisation. The Hacker News dates the complaints by BEUC members to November 2018, filed with national data protection authorities; The Irish Times writes that they came from eight European countries. The sources do not say which organisation filed first.
The entity sanctioned is Google Ireland Limited, the company's European seat — a point of jurisdiction, not symbolism.
| Who | Role, according to the sources | What the sources say about the link |
|---|---|---|
| Dr Des Hogan | DPC Commissioner | Signatory of the decision, per the DPC statement |
| Dale Sunderland | DPC Commissioner | Signatory of the decision, per the DPC statement |
| Niamh Sweeney | DPC Commissioner | Signatory of the decision, per the DPC statement |
| Graham Doyle | DPC Deputy Commissioner | The authority's only public statement quoted by sources |
| BEUC and member organisations | Complainants | Complaints from November 2018, from eight countries |
| Google Ireland Limited | Sanctioned entity | European seat; the DPC is its lead authority |
The mechanism: from a 2018 complaint to an order with a 2027 deadline
The chain has four links, each with a verifiable date. First: in November 2018, consumer organisations in several states file complaints with their national authorities. Second: in February 2020, the DPC opens an own-volition inquiry — the statement's exact phrase — triggered by those complaints. The distinction matters: the procedure does not resolve the complaints, it investigates the controller.
The third link explains why an Irish regulator decides for a continent. Article 56 GDPR establishes the one-stop-shop mechanism: for cross-border processing, the authority of the state where the controller has its main establishment leads the procedure, while the other authorities take part through the cooperation set out in Article 60. Google's European seat being in Dublin, competence falls to the DPC.
That the mechanism was used is confirmed by the statement itself, which thanks its "peer supervisory authorities" for their cooperation in the case.
The practical consequence for the Romanian reader is direct. The national supervisory authority cannot fine Google for this conduct on its own; it is the Irish decision that takes effect here too, and the compliance order covers the same settings on the Android phones sold in Romania.
The fourth link is the 2026 decision: a fine plus an order with a deadline. The effect the authority is aiming at is not budgetary but architectural — the way consent for location is requested.
The counter-hypothesis belongs here, not at the end. If the sanctioned practice ended on 4 February 2020, then the 2026 order demands compliance from a product that has changed several times since, and the measurable effect may be zero. The argument has an unexpected supporter: Google itself.
The fine or the order: which part of the decision bites
For a company of Google's size, €403 million is a predictable expense, not an existential threat. The compliance order is of a different nature: it is not paid, it is executed, and it has a deadline — March 2027.
The difference shows in what would have to be rewritten. "Location Accuracy" is an Android operating system feature, available, according to the DPC statement, to any Android user — including those without a Google account. "Web & App Activity", by contrast, governs what is retained at account level. Consent obtained on an informed basis, without nudges that push towards acceptance, narrows the volume of data available for ad targeting.
This is where the cost moves: from the profit and loss account into the product's architecture. A cost of that kind is not settled with a single payment.
The closest precedent comes from the same authority. In May 2025 the DPC fined TikTok €530 million over data transfers to China and used exactly the same instrument — a fine plus a six-month compliance order, with transfers to be suspended if the deadline is missed, according to the statement issued at the time. The structure of the 2026 decision is not an innovation but a routine of the authority.
The counter-hypothesis: the company says it has already changed its practices
The most serious objection to the thesis that "the decision changes something" comes from Google's own statement. The company said, according to BleepingComputer and The Irish Times, that the case "centers around historical policies that have since been updated" and that "from 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple".
If the claim holds up to verification, the compliance order is largely already executed and the decision remains a historical cost. If it does not, the next six months will produce visible changes in the interfaces. The available sources do not allow the question to be settled: they document the decision and the reaction, not the product's current state.
A note of precision about the sources: The Record writes that a Google spokesperson did not reply to its request for comment, while two other outlets quote the statement above. The divergence is about when the request was made, not about whether the company has a position.
There is a third reading, institutional. The Irish authority has been criticised for years over the pace at which it enforces the GDPR against companies based in Ireland, and a fine of this size, after six years, can also work as an answer to that criticism. The sources do not document such a motivation; it remains a plausible interpretation, not an established fact.
Where €403 million sits
The ranking is public and verifiable. According to The Irish Times, the fine is the fourth largest the DPC has imposed since the GDPR came into force, behind Meta — €1.2 billion in 2023 —, TikTok — €530 million in 2025 — and Instagram — €405 million in 2022.
Two things follow from that position. First: it is the DPC's first fine against Google, according to The Record. Second: the distance to third place is €2 million, or half a percentage point — a gap that could invert on appeal.
Euronews recalls that in July 2026 the European Commission fined Google €890 million. That is a separate procedure, with a different legal basis and a different decision-maker: the Commission's statement places it under the Digital Markets Act, not the GDPR. The two fines neither add up nor compare.
The Irish Times also notes that the DPC has three other large-scale Google inquiries at an advanced stage. If they conclude within the next two years, the September 2026 decision becomes the first in a series rather than an isolated case.
Scenarios
Dominant scenario — partial appeal and compliance in parallel. Driver: The Irish Times writes that Google is understood to be considering challenging elements of the decision. Constraint: appealing the fine does not automatically suspend the compliance order. Consequence: the sum is renegotiated in court for years, while the product changes happen anyway. Indicator: a case filed at the High Court in Dublin in the coming months.
Plausible scenario — compliance without dispute. Driver: the company's public position that its practices already changed in 2019. Constraint: accepting the decision sets a precedent useful for the three other DPC inquiries under way. Consequence: payment of the fine and a compliance announcement, at low reputational cost. Indicator: no court action before the appeal window closes.
Tail scenario — the decision becomes a European benchmark. Driver: publication of the full decision, with its legal classification, followed by other authorities relying on it. Constraint: the one-stop-shop keeps competence with the DPC for controllers based in Ireland. Consequence: compliance pressure across the whole location-based advertising sector. Indicator: the decision being cited in decisions by other national data protection authorities.
Verifiable predictions
| Prediction | Horizon | Probability | How to verify | Verification source |
|---|---|---|---|---|
| Google challenges at least one element of the DPC decision in court | by 31.03.2027 | 55–70% | A case appears with Google Ireland Limited against the DPC | Courts Service of Ireland, High Court register |
| The DPC publishes the full decision, with its legal classification | by 30.06.2027 | dominant scenario | The document appears in the authority's decisions section | dataprotection.ie, "Decisions" section |
| Google publicly announces changes to location consent in the EEA | by 21.03.2027 | 40–55% | An announcement on the official blog or in Android release notes | blog.google and Google support pages |
| At least one of the three other DPC inquiries into Google concludes with a decision | by 31.12.2027 | 35–50% | A decision announced or reported in the annual report | DPC Annual Report 2027 |
| The fine remains the fourth largest in the DPC ranking | at 31.12.2027 | plausible scenario | No DPC fine above €403 million in the interval | DPC Annual Report 2027, authority statements |
Method, definitions and figures
The authority. The Data Protection Commission (DPC) is Ireland's supervisory authority within the meaning of the GDPR. The term "lead supervisory authority" designates, under Article 56, the authority competent for a controller's cross-border processing, determined by the location of its main establishment in the Union.
The three features, as the DPC defines them. "Web & App Activity" is an account setting available only to Google Account holders; when enabled, it processes activity on Google services, including browsing history, search history and location data. "Location History" is an opt-in service that infers places visited, activities and routes between them, displayed on a private map through the "Timeline" feature.
"Location Accuracy" is an Android operating system feature that lets a device determine its location more precisely than by relying on its own GPS alone. Unlike the other two, it is available to any Android user, whether or not they hold a Google Account. The names are kept in the original: Romanian commercial translations of these settings have varied over time and would break the correspondence with the official document.
The period. The interval 25 May 2018 – 4 February 2020 is the scope of the inquiry, not the duration of the practice. The sources do not establish when the analysed conduct actually began, nor whether it continued after the scope closed.
Currency conversion. The dollar equivalents — $462 million and $463 million — come from two different outlets, at exchange rates from different days. The one-million difference is a matter of exchange rate, not of the sum: the fine is denominated in euro in the decision.
The ranking. The order of DPC fines is the one reported by The Irish Times on the day of the decision and refers exclusively to fines imposed by the Irish authority. Fines imposed by the European Commission — including the €890 million one from July 2026 — have a different legal basis and a different decision-maker, so they do not belong in the same ranking.
The probabilities. The bands in the predictions table are editorial estimates expressed in intervals of at least ten percentage points, without calibration against a track record of outcomes; they indicate the order of magnitude of confidence, not a measured frequency.
Limits of the analysis
The analysis rests on the DPC statement and on five press reports published within 24 hours of the decision. The full decision was not published at the time of writing, so the legal classification — the GDPR articles relied on and the method of calculating the amount — cannot be independently verified.
What this article cannot establish: whether the Google practices described for 2018–2020 are still in place today. The company's claim that it changed them in 2019 has not been verified by independent sources, and verifying it would require an audit of current consent flows, not a reading of press statements.
The diagnosis would be invalidated by two developments: publication of the full decision with a classification showing narrower findings than the statement suggests, or a judicial suspension of the compliance order, which would void the central argument about the binding force of the six-month deadline.
The natural point for re-evaluation is the expiry of that deadline, in March 2027, or earlier if the DPC publishes the full decision or if Google files a court action.
