Google's €403m Location Fine: What It Means for Geo Targeting and Store-Visit Measurement

If your campaigns use radius targeting, store-visit conversions or audiences built from places people go, the regulator's latest decision on Google's location data is worth reading. On 21 September 2026 Ireland's Data Protection Commission (DPC) found that, between May 2018 and February 2020, Google processed location data in three features in breach of the GDPR's rules on lawfulness, fairness, transparency, accountability and retention. It fined the company €403 million and ordered it to comply within six months. Nobody outside Google yet knows what compliance will look like, so check how much of your plan depends on it.

What the DPC found

The DPC opened the inquiry on its own initiative in February 2020, after complaints from several European consumer rights organisations, including BEUC. It covered three features, "Web & App Activity", "Location History" and "Location Accuracy", between 25 May 2018, when the GDPR began to apply, and 4 February 2020.

According to the DPC's announcement, Google infringed the GDPR in respect of:

• "the lawfulness and fairness of its processing of location data in Web & App Activity and Location History";
• "its accountability obligations under the GDPR by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle regarding its processing of personal data in Location Accuracy";
• "its transparency obligations in respect of all three features referred to above";
• "its retention of location data in Web & App Activity and Location History".

The European Data Protection Board's summary lists the legal references as Articles 5 (principles), 6 (lawfulness), 12 (transparent information) and 13 (information given at collection); the DPC's announcement cites none. Neither page breaks down the fine, and the DPC will issue the full decision in due course.

The advertising link is in the regulator's own words. Deputy Commissioner Graham Doyle said that because of Google's failures, "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests", and that keeping the data "for longer than necessary aggravated this loss of control".

Two findings matter beyond Google. The DPC says users must opt in to Location History, yet its processing still breached lawfulness and fairness, and the transparency finding covers it too. Opting in did not settle the question. And retention was an infringement in its own right.

What Google must change, and what it has said

The order is to "bring its processing into compliance within 6 months". The published pages do not say when the period starts; counted from 21 September, it would end around late March 2027. Nor do they say what compliance requires, or whether it reaches Google's ad products.

In a statement reported by The Irish Times and RTÉ, Google said the case centres around "historical policies" that have since been updated. A spokesperson said: "From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple." The Irish Times reports that users can now have data deleted automatically after three to 36 months, that Timeline location data in Google Maps is stored on users' devices, and that ad personalisation controls have been simplified. On an appeal, both outlets cite unattributed briefing: The Irish Times wrote that "it is understood that Google may appeal elements of the decision", and RTÉ that Google is understood to plan an appeal on legal issues needing clarification beyond this case. We found no on-the-record statement from Google that it will appeal.

What advertisers should prepare for

We found no announcement from Google of a product change in response. What follows is not a forecast but a set of scenarios to plan around, because the DPC itself names ads and interest inference as uses of the data it examined.

In every scenario, the exposed advertiser is the one whose budget decisions depend on a platform signal it cannot see or audit. The work is to reduce that dependence and measure beyond the click.

Reducing dependence on platform location signals

1. List every campaign that uses store visits, local actions or place-based audiences as a bidding goal. These are the ones that would move first if the signal thins.
2. Build an outcome you own for offline sales: booking references, coupon codes, loyalty sign-ups at the till or CRM records matched to leads. Your own figures still hold if a platform's reported store visits change.
3. Test geography directly instead of inferring it. A geo-lift test changes spend by region and reads your own sales, so it needs no location history from the user.
4. Use contextual and declared location: the city a customer types into a search, the delivery postcode they give you, the region a store page serves.
5. Invest in first-party data collected with a clear notice and a lawful basis, so the audiences you build rest on records you can show a regulator.

What the decision teaches anyone collecting location data

The findings are specific to Google, but the principles apply to anyone processing location data under the GDPR, including Cyprus businesses with a delivery, booking, travel or loyalty app. Their supervisor will usually be the national data protection authority, applying the same regulation.

Retention is the question this case made a finding of its own. Keeping everything indefinitely is easy to build and hard to justify. The third question matters too: the Location Accuracy finding was about failing to demonstrate compliance, which is a records problem as much as a design one.

For UK readers, the UK GDPR rests on the same core principles, as the ICO's guide sets out, so the check applies there too. The DPC decision binds only Google, but it shows how an EU regulator reads lawful basis, notice and retention for location data.

This week, run the five questions against your app or site and list the campaigns that depend on platform location signals. If both lists are short, the next six months of Google's compliance work are something to watch, not something to fear.