Google has been fined €403 million (about £345 million, or Tk 5,700 crore) by Ireland's Data Protection Commission (DPC) over the way it handled users' location data. The penalty, announced on Monday, is one of the largest the Irish regulator has ever imposed and closes an inquiry that began six years ago after complaints from consumer-rights groups across Europe.
What the regulator found
The DPC looked at three features of a Google account: Web & App Activity, Location History and Location Accuracy, and at how they were used between 25 May 2018, the day the EU's General Data Protection Regulation (GDPR) took effect, and 4 February 2020. Its conclusion is that Google processed location data in a way that was not "lawful", "fair" or "transparent", the three basic conditions the GDPR sets for handling anyone's personal data.
Location data "can reveal a significant amount of information about an individual, including information that is inherently private", said deputy commissioner Graham Doyle. Because of Google's failures, he said, people "could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data". Keeping the data longer than necessary, he added, made that loss of control worse.
Besides paying the fine, Google has been ordered to bring its processing into compliance within six months.
Google's reply
Google says the case "centres around historical policies that have since been updated". Since 2019, it says, it has launched "industry-first auto-delete controls" that let any user set an account to erase activity automatically every three, 18 or 36 months, a simpler switch to turn personalised ads off entirely, and consolidated explanations of what its location settings do. Google is the Irish regulator's regular customer: Ireland hosts its European headquarters, so the DPC is the lead authority for its GDPR compliance across the whole EU.
Why a Bangladeshi should care
The GDPR does not protect anyone in Bangladesh, and the country still has no independent data-protection regulator; a personal data protection ordinance has been in draft and debate since 2022. But the three settings in the ruling are the same on every Android phone in Dhaka as in Dublin, and what they do has not changed: Web & App Activity records your searches and app use, Location History (now called Timeline) keeps a diary of where the phone has been, and Location Accuracy lets Google use Wi-Fi and mobile networks to pin the phone down when GPS cannot. Ads you see, "popular times" at a shop, and traffic on Google Maps are all built from that data.
How to check your own settings
- Open myactivity.google.com (or Settings → Google → Manage your Google Account → Data & privacy on the phone).
- Under History settings, open Web & App Activity. Turn it off, or keep it on and set Auto-delete to 3 months; the default is 18.
- Open Timeline (Location History). Since 2024 this lives on the phone rather than in the cloud; you can delete it, or turn it off.
- On the phone go to Settings → Location → Location services → Google Location Accuracy. Turning it off makes maps a little slower to find you and stops the Wi-Fi scanning.
- Under My Ad Centre, switch personalised ads off if you would rather see generic ones.
None of this stops Google from working; it only decides how much the company remembers about you. The Irish ruling is a reminder that, for almost two years, it remembered more than it told you.
