Google challenges €403 million EU fine over location data processing

The fine and the findings

Google Ireland has brought a High Court challenge to a €403 million fine imposed by Ireland's Data Protection Commission (DPC) over the processing of users' location data.

On September 16, 2026, the DPC notified Google Ireland Ltd that it had made eight findings of infringement of the General Data Protection Regulation (GDPR) in relation to three features: Web & App Activity, Location History, and Google Location Accuracy.

The DPC found Google had unlawfully processed location data with the user's activity when Web & App Activity was enabled, and in Location History, where Google relied on consent and the purpose of performing research and providing aggregate reporting, including ads measurement. It also found Google kept location data associated with the user in their account when Web & App Activity was enabled "in a form permitting the identification of data subjects for longer than was necessary for the purposes for which those data were processed".

The commission further found Google failed to demonstrate compliance with the GDPR principle of lawfulness, fairness and transparency in processing data in Google Location Accuracy.

As corrective measures, the DPC imposed eight administrative fines totalling €403 million, issued a reprimand, and ordered Google to bring its processing into compliance within six months.

Google's challenge

Google Ireland launched judicial review proceedings seeking orders annulling the decision in part and/or in whole. If necessary, it also sought a stay on the decision and a referral to the Court of Justice of the European Union.

Google says the DPC decision contains, and is vitiated by, a multiplicity of errors of law and fact, including manifest errors of assessment, errors concerning the scope and conduct of the inquiry, and errors in the DPC's exercise of its corrective powers. It also intends to challenge the constitutionality of certain parts of the Data Protection Act 2018 and compatibility with the European Convention and the Charter of Fundamental Rights of the European Union.

In an affidavit seeking entry of the case to the Commercial Court, Patrick Flynn, vice president of geo operations of Google Ireland, said the proceedings were appropriate for the fast track commercial list given the value of the fines involved and the material impact the decision would have on the company's operations. Google Ireland contends that compliance with any changes required by the decision will be disruptive and burdensome and will entail incurring significant cost.

On Monday, on the application of Paul Gallagher SC, for Google Ireland, and on consent from Michael Cush SC, for the commission, Ms Justice Eileen Roberts entered the case to the commercial list and adjourned it.

Why it matters

The case tests the enforcement of GDPR against a major technology company over location data practices and could affect how Google operates three of its features in the European Union.

Sources

• irishtimes.com: Google challenges €403m fine over processing of user location data – The Irish Times
• irishexaminer.com: Google launches challenge to €403m data protection fine in High Court

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.