Google's €403 Million Fine: What It Means for Your Location Data

Ireland's Data Protection Commission has fined Google €403 million over how it collected and used location data, and the case lands on a question a lot of people have never thought to ask: do you actually know which Google settings are tracking where you go? The decision names three specific features — Web & App Activity, Location History (now called Timeline), and Location Accuracy — and finds that Google handled location data from all three in ways that broke EU data protection law. Below is what the regulator found, and then the concrete steps for checking and switching off these settings in your own account.

What did Google do wrong with location data?

The DPC acted on its own initiative rather than on a single complaint, after European consumer rights organisations including BEUC raised concerns about Google's location practices. It opened the own-initiative inquiry in February 2020 and examined Google's conduct going back to 25 May 2018, the day the GDPR took effect, through to 4 February 2020.

The inquiry's scope was narrow and specific: "the Inquiry concerned Google's processing of location data in three specific features – 'Web & App Activity', 'Location History' and 'Location Accuracy'," according to the DPC's decision summary. Within that scope, the DPC identified four distinct problems. It found Google lacked a lawful and fair basis for processing location data in Web & App Activity and Location History. It found Google could not demonstrate it had met its accountability obligations around Location Accuracy. It found transparency failures across all three features. And it found Google kept location data from Web & App Activity and Location History for longer than necessary.

The European Data Protection Board's case summary ties these findings to specific articles of the GDPR: Article 5 on the principles governing how personal data may be processed, Article 6 on lawfulness, and Articles 12 and 13 on the information companies must give people about how their data is used. The DPC ordered Google to pay the €403 million fine and to bring its processing into line with the law within six months.

Deputy Commissioner Graham Doyle put the practical consequence plainly: "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," he said, adding that holding onto that data longer than needed "aggravated this loss of control," per the DPC statement. In other words, the core problem wasn't just that Google collected location data — it's that people often had no clear way of knowing it was happening, or that switching off one setting didn't stop another from doing the same job.

How do I check my Google Location History and Timeline?

Location History is the feature Google now calls Timeline. Google's own description of it matches what the DPC flagged: Timeline automatically records the places you visit and routes you take, building a private map tied to your signed-in devices. Google's support page states that "even when Google apps aren't in use, your precise device location is regularly saved to your device," with an option to back up an encrypted copy to Google's servers, according to Google's Timeline help page.

To see what Timeline has saved about you, go to the "Timeline" section of your Google Account. From there you can review the trips and places logged, turn the feature on or off at the top of the screen, and delete specific entries or your entire history. Google's own instructions reduce it to two steps: "Go to the 'Timeline' section of your Google Account" and "At the top, turn Timeline on or off," per Google's account help pages. If you've ever enabled it — intentionally or by accepting a prompt without reading it — it's worth checking whether it's still running.

What is Web & App Activity and what location data does it collect?

This is the setting the DPC's findings focused on most heavily, and it's also the one most people have never looked at directly. The DPC describes it as "a Google account setting that is only available to Google Account holders," which when switched on causes Google to process data about your activity across its services — including sites and apps you use, your browsing history, your search history, and your location, according to the DPC's summary.

The important distinction the regulator drew out is that Web & App Activity is separate from Timeline, and the two don't automatically switch off together. Google's own support documentation confirms this directly: "If settings like Search Services History or Web and App Activity are on but you turn off Timeline or delete your Timeline data, your Google Account may still save location data as part of your use of other Google sites, apps, and services," per Google's help page. That's effectively the structural problem the DPC penalized — a person could believe they'd stopped location tracking by turning off one feature, while a second feature kept collecting the same kind of data in the background.

You can review and manage Web & App Activity through your Google Account's Activity Controls, where you can see what's being saved, turn the setting off, or delete existing entries. For a fuller walk-through of locking down related settings on your phone, our Android privacy settings checklist covers this alongside other controls worth checking.

How do I turn off location tracking on Google?

There isn't one single switch, which is part of what the DPC's decision exposes. Location Accuracy sits apart from the other two features entirely — it's not a Google Account setting but a feature built into the Android operating system itself, and it's available to anyone using an Android device, "regardless of whether they are Google Account holders," according to the DPC. It allows a device to determine its location with greater accuracy than relying on GPS alone. Because it lives in the phone's operating system rather than your Google Account, it has to be checked through your device's own location settings menu rather than through Google's account pages.

That leaves three separate places to check if you want tracking fully stopped: your device's system-level location settings, Timeline in your Google Account, and Web & App Activity in your Activity Controls. Turning off one doesn't turn off the others, as Google's own documentation states above. If ads based on your location are the specific concern, Google's My Ad Center lets you turn off personalized ads outright: "When you turn off personalized ads, Google will not use the information and activity saved to your Google account or your choices in My Ad Center to show you ads," with ads instead shown based on general factors like time of day or page topic, according to Google's ad settings help page. The Manage Privacy tab in My Ad Center also lets you see and adjust "areas from where you've used Google" as a category feeding ad personalization. For the equivalent steps on iPhone as well as Android, see our guide on how to stop personalized ads based on location.

How do I delete my location data from Google?

Deletion works setting by setting, mirroring how collection works. Inside Timeline, you can delete individual visits, specific date ranges, or your entire location history, using the controls in the same "Timeline" section of your account where you toggle the feature on or off, per Google's support instructions. Inside Web & App Activity, Google's Activity Controls similarly let you view a list of saved activity and delete all or part of it.

The DPC's finding on excessive retention is a reason to not just turn these features off but to check what's already stored. The regulator found that Google's "retention of location data in Web & App Activity and Location History" ran longer than necessary, as stated in both the DPC's decision summary and the EDPB's case summary. Deleting existing history clears out data collected under the practices the regulator found unlawful, even after you've switched the settings off going forward.

If you want a complete picture of everything Google holds on you beyond these three features — not just location but the full account record — you can file a formal request for your data. Our guide on how to make a GDPR data request explains how EU residents can ask any company, including Google, to hand over everything it has stored under your name.