When a major GDPR fine is announced, privacy teams often ask: "What exactly did they violate?" The Ireland DPC's €403 million fine against Google provides clear insights. Here's what practitioners are asking about location data compliance, with direct responses based on the regulator's findings.
Understanding the Concerns
These questions aren't theoretical. They're the ones privacy officers asked when the Google location data decision was made public, and they're the same questions you'll face when auditing your own location tracking features. The DPC examined three specific Google features between May 25, 2018, and February 4, 2020: Web and App Activity, Location History, and Location Accuracy. The violations focused on transparency failures and excessive retention. Here's how this affects your compliance program.
Q1: What's the difference between "processing location data" and "violating transparency obligations"?
You can process location data lawfully under GDPR, but you can't keep users in the dark about what you're doing with it.
The DPC found that Google failed to meet transparency obligations across all three features. Deputy Commissioner Graham Doyle stated that "individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests."
Transparency under GDPR isn't just a checkbox. Article 13 requires you to inform users about the specific purposes of processing, the categories of data involved, and the retention periods. If you're using location data for ad targeting, you must state that explicitly. If you're combining location with browsing history to build profiles, say so.
Your audit question: Can a user read your privacy notice and accurately predict how their location data will be used? If they need to guess, you've got a transparency gap.
Q2: We offer location features as Consent. Does that automatically satisfy consent requirements?
No. Consent controls the legal basis, but transparency and data minimization apply regardless of your lawful basis.
Google's Location History was an Consent service, yet the DPC found violations. The issue wasn't whether users chose to enable the feature; it was that Google "failed to demonstrate compliance with GDPR principles" when processing that data.
Even with valid consent under Article 7, you must still comply with Article 5 principles: transparency, purpose limitation, data minimization, storage limitation. Your consent mechanism doesn't exempt you from explaining what you'll do with the data or from deleting it when it's no longer necessary.
Q3: How long can we retain location data before it becomes "longer than necessary"?
There's no universal retention period. The DPC evaluates necessity against your stated purpose.
Google retained location data collected through Web & App Activity and Location History "longer than necessary." The regulator didn't specify an acceptable timeframe because necessity depends on what you're using the data for.
If you're using location data for navigation, you need it during the trip, not three years later. If you're using it to analyze traffic patterns, you might justify aggregated retention for trend analysis, but you'll need to explain why you need individual-level location points beyond the analysis window.
Your retention rule must connect directly to your processing purpose. Document that connection. When the purpose expires, the retention justification expires with it.
Since 2019, Google has implemented auto-deletion controls and now stores Maps Timeline data on-device with automatic removal after three months. That's a response to regulatory pressure, not a GDPR-mandated timeline.
Q4: We don't save "precise" location, just general area. Does that reduce our compliance obligations?
Reduced precision reduces risk, but it doesn't eliminate your transparency and minimization obligations.
Google now states it doesn't save precise device location in Web & App Activity, only an estimated general area. That's a data minimization improvement, but you still must explain what "general area" means and what you're doing with it.
Under Article 4(1), personal data includes any information relating to an identified or identifiable person. A general area can still be personal data if it's linked to other identifiers. If you're combining approximate location with search queries, browsing history, or device IDs, you're still processing personal data that requires full GDPR compliance.
Reducing precision is a good practice. It doesn't replace transparency.
Q5: Our location feature runs on Android but doesn't require a user account. What's our compliance scope?
If you're processing personal data, GDPR applies regardless of account status.
Google's Location Accuracy feature is available on Android "regardless of whether the user has a Google Account." The DPC still examined it for GDPR compliance. The regulator found Google "failed to demonstrate compliance with GDPR principles" when processing data through this feature.
Your compliance scope follows the data, not the authentication model. If you can link location data to a device identifier, IP address, or any other element that makes a person identifiable, you're processing personal data. Article 30 requires you to maintain records of processing activities. Article 32 requires appropriate security measures. Article 5 requires you to demonstrate compliance with all principles.
Q6: What does "failed to demonstrate compliance" actually mean?
It means the burden of proof is on you, and documentation matters.
The DPC's language is specific: Google "failed to demonstrate compliance with GDPR principles." That's different from "violated GDPR principles." Under Article 5(2), you must be able to demonstrate compliance with the accountability principle.
You need documentation showing how you determined your retention periods, how you assessed necessity, how you validated that your privacy notices accurately describe your processing. When a supervisory authority investigates, "we think we're compliant" isn't sufficient. You must produce evidence.
Build your compliance documentation as you build your features, not when the investigation notice arrives.
Q7: Consumer advocacy groups triggered this investigation. Should we monitor complaints filed against competitors?
Yes. Complaints from organizations like NOYB often signal enforcement priorities.
The DPC launched its investigation in February 2020 "after receiving multiple complaints from consumer rights organizations." These weren't individual user complaints; they were coordinated advocacy efforts that prompted regulatory action.
Monitor complaints filed with supervisory authorities in your jurisdiction. They reveal what practices are drawing scrutiny. If advocacy groups are challenging consent patterns, location tracking, or data retention across your industry, assume your practices will eventually face similar examination.
Consumer advocacy organizations have become effective enforcement accelerators. Treat their public complaints as early warning signals.
Where to Go for More
Review the DPC's published decision when it becomes available. The full text will include specific findings on transparency language, retention justifications, and compliance demonstrations that didn't appear in the initial announcement.
For location data specifically, consult the Article 29 Working Party's Opinion 13/2011 on geolocation services. While it predates GDPR, it establishes core principles on consent, purpose specification, and data minimization that remain relevant.
If you're processing location data at scale, document your compliance before you need to demonstrate it. The €403 million fine reflects what happens when you can't.
