Google fined $403 million for privacy: what it teaches companies
There Irish Data Protection Commission has fined Google €403 million for GDPR violations related to the processing of location data. The case concerns practices between 2018 and 2020, but it highlights a current issue for businesses: knowing where data ends up after it's been collected.
There Irish Data Protection Commission (DPC). imposed administrative fines on Google Ireland totalling 403 million euros at the end of an investigation into the processing of location data.
The decision, announced on September 21, 2026, concerns three Google features: Web & App Activity, Location History and Location Accuracy. The period examined goes from May 25, 2018 to February 4, 2020.
The authority also ordered Google to adapt the contested processing within six months.
The case involves a platform and a quantity of data that are difficult to compare with those of an SME. The practical principle, however, is much closer: collecting data also means knowing why it is collected, where it is transferred and how long it remains available.
Why Google was fined for privacy
The DPC investigation was launched in February 2020 following reports from European consumer protection organizations.
According to the authority's decision, Google violated several obligations under the GDPR.
The disputes concern:
- lawfulness and correctness of the processing of location data through Web & App Activity and Location History;
- accountability obligations relating to Location Accuracy;
- transparency of processing for all three features;
- location data storage through Web & App Activity and Location History.
L'accountability, in the GDPR, indicates the owner's ability to concretely demonstrate that data processing is carried out in compliance with the applicable rules.
Therefore, it is not enough to establish a procedure internally: you also need to be able to document it.
Why location data requires special attention
A single piece of geographic data may seem insignificant.
A sequence of positions collected over time can instead reconstruct the person's movements, places frequented, and habits.
The DPC emphasizes that location data can provide very detailed information about an individual's life and that, in the case analyzed, users may not have fully understood how that information was being used, including to influence the advertising displayed or infer interests.
It is precisely the connection between different data that makes treatment mapping important.
The same principle applies, on a much smaller scale, to the tools used by a company on a daily basis.
After the contact form the data path continues
On the site a user fills in three fields:
name, email, telephone.
When you press “Send” you will see a confirmation message appear.
From his point of view the operation is finished.
From a technical point of view it may have just begun.
The request could arrive via email, be recorded in the CRM, go through an automation, enter a management system, or be transferred to a marketing platform.
They are perfectly normal activities when there is a reason for doing them and they are managed properly.
The problem arises when no one can reconstruct the complete route.
A site changes faster than its documentation
A company website rarely remains the same for years.
A chat is added. The newsletter system is changed. A new module is installed. A CRM is added. A campaign is launched with a dedicated landing page. A booking or support system is connected.
Each intervention can introduce new steps in information management.
Over time, a distance can therefore be created between what the company plans to use and what is technically still connected.
An integration created for an old campaign may still be active. A form may continue to save information in the site's database. A platform that is no longer in use may still receive data.
This does not automatically mean that a violation exists.
This means that before we can establish this, we need to know how the system actually works.
Privacy policy and technical operation must match
The presence of a privacy policy alone is not enough to describe actual data processing.
As tools, integrations, and platforms are added over time, the documentation also needs to be verified against the actual configuration.
A comparison between two levels is therefore needed:
what the site states is what the site actually does.
The legal assessment is the responsibility of privacy professionals. However, the technical work must provide reliable information on the forms, cookies, platforms, databases, integrations, and services actually used.
Without this map, even a regulatory assessment starts from incomplete information.
How to check the data path on your site
An initial check can start with a very simple operation: actually fill out one of the site's forms and follow what happens.
You have to ask yourself:
- where the request is sent;
- if the data is also saved on the site;
- if they automatically enter the CRM;
- if they are transferred to marketing platforms;
- which users can consult them;
- if there are exports or automations;
- if old additions are still present;
- how long the information is retained.
This exercise does not replace a GDPR audit.
It serves to build the technical foundation necessary to do it correctly.
What this means for your business
The Google fine doesn't mean that all data collection is problematic. However, it does demonstrate the importance of understanding the entire information cycle.
For an SME, the first checks can be very concrete:
- map forms, CRM, newsletters and related platforms;
- check if there are any additions that are no longer necessary;
- Compare the technical configuration with the current privacy documentation.
The useful question is not only “What data do we collect?”, but also “What happens next?”.
When DigiFe intervenes on the creation or renovation of a website, analytics isn't just about what the user sees: it also includes integrations, modules, and tools that make the project work behind the interface.
