Google’s tracking of Europeans spawns $462 million fine

Ireland’s privacy watchdog gave Google six months to fix its handling of location data after finding it broke EU rules. Google said it would appeal.(CN) — Google’s tracking of users’ whereabouts in Europe drew a fine of 403 million euros (about $462 million) from Ireland’s privacy watchdog on Monday, nearly eight years after consumer groups raised the alarm.Ireland’s Data Protection Commission, Google’s lead privacy regulator in Europe, also gave the company’s Irish subsidiary six months to bring its handling of location data into compliance with EU law. That deadline covers changes to its practices. The fine requires court approval before it can be collected.Seven consumer organizations filed complaints in November 2018 in an effort coordinated by the European Consumer Organisation, known as BEUC. A Danish group separately reported the practices to its national authority. The groups sought an investigation, a halt to unlawful uses of location data, particularly for advertising, and a fine with enough bite to deter further violations.The commission opened its inquiry in February 2020. It examined Google’s practices from May 25, 2018, when the EU’s General Data Protection Regulation went into effect, through Feb. 4, 2020. The law was designed to give people more control over their personal information and set limits on how companies collect, use and keep it.It found Google had handled location data unlawfully and unfairly through Web & App Activity and Location History, kept it too long and failed to explain its practices clearly enough. Web & App Activity could combine location with searches and browsing activity. The opt-in Location History service mapped people’s movements through Timeline even when they were not using a Google service.For Location Accuracy, which improves Android positioning beyond GPS alone, Google failed to demonstrate that it handled data lawfully, fairly and transparently. The commission also found users were not adequately informed. The finding about demonstrating compliance was distinct from the unlawful processing findings for the other features. Location Accuracy also worked without a Google account.Graham Doyle, deputy commissioner at Ireland’s privacy regulator, said location data could improve services while exposing deeply private information. Users could have been unaware that their whereabouts helped target ads or reveal their interests, he said. Keeping that information too long further eroded their control.The groups’ model complaint said Web & App Activity was enabled by default, with information about location collection tucked behind extra clicks. Users who declined Location History faced repeated prompts across Google services. Even getting photos sorted by location meant accepting broader tracking and advertising uses, according to the groups.The groups argued choosing a useful feature did not mean freely consenting to every use of data bundled with it. They also rejected Google’s advertising interests as a justification for such intrusive tracking.Agustín Reyna, director general of BEUC, welcomed the decision but criticized the nearly eight-year wait, saying delayed enforcement could be as harmful as none. He described it as confirming that Google had obtained consent unlawfully and accused the company of tracking hundreds of millions of Europeans for years, potentially exposing children’s schools, hospital visits and places of worship.BEUC said Google had changed its practices worldwide following the complaint but had not sufficiently addressed deceptive design, prompting another complaint in 2022.“This case centers around historical policies that have since been updated,” a Google spokesperson said. The company cited changes since 2019, including automatic deletion options after three, 18 or 36 months and Timeline storage on users’ devices. It said automatic deletion of data older than three months was now the default for users first turning on Timeline.Google also pointed to controls for personalized and location-based advertising, a single hub explaining its practices and a policy of saving only an estimated general area, rather than precise device location, in Web & App Activity for searches.The fine was the commission’s fourth largest under the EU privacy law. Three other major Google inquiries are at an advanced stage, it said.Google said it planned to appeal over specific legal uncertainties requiring clarification beyond this case. Irish law allows 28 days from notification to challenge a fine of this size in the High Court, which can uphold, change or overturn it. An appeal would put collection on hold until the challenge is resolved.Courthouse News reporter Eunseo Hong is based in the Netherlands.Subscribe to our free newslettersOur weekly newsletter Closing Arguments offers the latest about ongoing trials, major litigation and rulings in courthouses around the U.S. and the world, while the monthly Under the Lights dishes the legal dirt from Hollywood, sports, Big Tech and the arts.Additional Reads