EU fines Google $463M for violating GDPR privacy rules

Google just got hit with another nine-figure bill from European regulators. Ireland’s Data Protection Commission slapped the tech giant with a €403 million fine, roughly $463 million, for violating the EU’s General Data Protection Regulation through its handling of users’ location data. The penalty marks the DPC’s fourth-largest fine under GDPR and covers a period stretching from May 25, 2018, to February 4, 2020. What Google actually did wrong The DPC’s investigation zeroed in on three specific features: “web and app activity,” “location history,” and “location accuracy.” All three were found to process location information in ways that violated GDPR’s core principles of lawfulness, fairness, and transparency. The core problem was straightforward. Users didn’t adequately understand how their location data was being harvested, retained, and then fed into Google’s advertising and interest-inference engines. The commission also flagged unreasonable data retention periods, meaning Google was holding onto location information longer than users might reasonably expect. The investigation itself traces back to complaints filed by several European consumer rights organizations, including t...