Ireland's Data Protection Commission (DPC) fined Google €403 million for GDPR violations from May 25, 2018, to February 4, 2020, specifically around lawfulness, fairness, and transparency in location data processing. The regulator found that users "could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests."
If your organization processes location data, you need a transparency checklist that demonstrates compliance before a supervisory authority asks for it.
Purpose of the Checklist
This checklist helps you document your location data processing practices to satisfy GDPR's transparency requirements under Articles 13 and 14. Use it to audit your current notices, identify gaps, and create a compliance record that shows you've addressed lawfulness, fairness, and transparency as interconnected obligations.
The DPC's finding that Google failed to demonstrate compliance with these principles reveals a critical point: you can't prove transparency after the fact. You need contemporaneous documentation showing what users knew, when they knew it, and how you verified their understanding.
Prerequisites
Before using this checklist, gather these materials:
- All privacy notices mentioning location data processing
- Screenshots or archived versions of consent flows requesting location access
- Data flow diagrams showing how location data moves through your systems
- Records of the actual purposes for using location data
- Retention schedules for location data across all processing contexts
You'll also need access to someone who understands your advertising systems, analytics platforms, and any third parties receiving location data. The DPC specifically noted Google's failure to inform users that location data was being used "to influence them with ads or to infer their interests." If you're doing secondary processing, you need to know about it before you can disclose it.
The Transparency Checklist
Section 1: Collection Point Disclosure
For each place where you collect location data, verify:
☐ Timing of notice: Is the privacy information presented before or at the moment of collection, not after?
☐ Identity disclosure: Do you clearly state your organization's name and contact information?
☐ DPO contact: If you have a Data Protection Officer, is their contact information provided?
☐ Purpose specificity: Does each stated purpose describe a concrete outcome? (Bad: "improve services." Good: "calculate delivery time estimates for your orders.")
☐ Lawful basis identification: Have you stated which Article 6 lawful basis applies to each purpose?
☐ Legitimate interests justification: If you're relying on legitimate interests, have you explained the specific interest and why it overrides the user's privacy rights?
Section 2: Secondary Use Disclosure
This section addresses the DPC's finding that users were unaware location data was being used for advertising and interest inference:
☐ Advertising use: If location data informs ad targeting, personalization, or measurement, is this explicitly stated?
☐ Profiling disclosure: If you infer interests, preferences, or characteristics from location patterns, have you disclosed this as automated decision-making or profiling under Article 22?
☐ Analytics purposes: If location data feeds into product analytics, user research, or business intelligence, is each use case separately disclosed?
☐ Compatible processing assessment: For any purpose not disclosed at collection, have you documented your Article 6(4) compatibility assessment?
Section 3: Retention Transparency
The DPC found Google retained location data "for longer than necessary," which "aggravated this loss of control":
☐ Retention period stated: Have you specified how long you keep location data for each purpose, using concrete time periods rather than vague phrases like "as long as necessary"?
☐ Retention criteria disclosed: If you can't state a fixed period, have you explained the criteria you use to determine when to delete location data?
☐ Purpose-specific retention: Do your retention periods differ by purpose? (Location data for fraud detection may have different retention needs than data for navigation features.)
☐ Aggregation timeline: If you aggregate or anonymize location data, when does this happen, and have you disclosed the timeline?
Section 4: Recipient and Transfer Disclosure
☐ Third-party recipients listed: Have you named or categorized every third party that receives location data?
☐ Recipient purposes: For each recipient, have you explained what they do with the location data?
☐ International transfers: If location data leaves the European Economic Area, have you disclosed the destination countries and the safeguards in place (adequacy decision, Standard Contractual Clauses, etc.)?
Section 5: Rights Information
☐ Access right: Have you explained how users can request a copy of their location data?
☐ Right to be Forgotten: Have you explained how users can request deletion of their location data?
☐ Restriction right: Have you disclosed the right to restrict processing while you verify accuracy or assess a legitimate interests objection?
☐ Objection right: If you're processing location data based on legitimate interests or for direct marketing, have you disclosed the right to object?
☐ Right to Lodge a Complaint: Have you provided the name and contact details of your lead supervisory authority?
Customizing the Checklist
Adapt this checklist to your specific processing activities:
For mobile apps: Add checkpoints for operating system permission requests. iOS and Android permission dialogs are not substitutes for GDPR transparency, but they're often the first interaction. Document how your in-app notice complements or contradicts the OS-level permission request.
For web services: Include checkpoints for cookie banners and browser geolocation API prompts. If you're collecting location via IP address rather than explicit user permission, document your lawful basis and whether this constitutes a compatible use.
For IoT devices: Add verification that transparency information is accessible on the device itself or through a companion app, not just buried in a web-based privacy policy.
Validation Steps
Cross-reference with actual processing: Pull a sample of location data records from your systems. Trace each data point back to a disclosed purpose. If you find location data being used for a purpose not on your checklist, you've identified a transparency gap.
Test user comprehension: Show your privacy notice to someone outside your legal or privacy team. Ask them to explain back to you what happens to their location data. If they can't articulate the advertising use case or the retention period, your notice fails the fairness test.
Document your evidence: For each checked box, note where the evidence lives (privacy notice version, consent flow screenshot, data flow diagram reference). The DPC found Google failed to "demonstrate compliance." Your checklist is only useful if you can show a supervisory authority exactly where each requirement is satisfied.
Review on a schedule: Set a quarterly review. Any time you add a new feature, analytics tool, or advertising partner that touches location data, run through the checklist again. The Google investigation covered practices from May 2018 to February 2020. Compliance isn't a point-in-time achievement.
If you can't check every box, you've found your roadmap. Prioritize the gaps that affect the most users or involve the highest-risk processing (advertising, profiling, cross-border transfers). The €403 million fine demonstrates that supervisory authorities will scrutinize location data practices. Your checklist proves you scrutinized them first.
