Google can learn a lot from a phone moving through the world. It can identify a place someone visited, the route taken to get there and the interests that trip may reveal.
Ireland’s Data Protection Commission says Google didn’t give European users enough control over how that information was processed.
The regulator fined Google €403 million over location data collected through Web & App Activity, Location History and Android’s Location Accuracy feature. The investigation covered activity from May 25, 2018, through February 4, 2020.
The commission found violations involving the lawfulness and fairness of Google’s processing, the information provided to users, Google’s ability to demonstrate compliance and how long it retained certain location data. Google has six months to bring the processing into compliance.
The advertising connection is explicit. The regulator said users may not have understood that Google could use their location to influence the ads they saw or infer their interests.
A visit to a store, dealership, gym or theater can help an advertising platform decide what someone may want next. The same visit can expose where that person goes, when they go and what their routine looks like.
The regulator says Google could use location to influence advertising and infer users’ interests. Ireland attached a €403 million penalty to how the company collected, explained and retained that information.
Three Settings Collected Different Pieces of the Trip
The case covers three Google features that process location in different ways.
Web & App Activity is a Google Account setting that can save activity across Google services. That information can include browsing history, search history and location data.
Location History creates a private map of places visited, activities and routes traveled with a signed-in device. Users had to opt in, but the feature could continue recording location while they weren’t actively using a Google service.
Location Accuracy is an Android feature that combines signals beyond GPS to improve a device’s estimated position. It can operate for Android users who don’t have a Google Account.
Those features serve different product functions. Together, they can describe what someone searched for, where the device went and which physical places may relate to that activity.
The regulator found transparency problems across all three. It also found problems with the lawfulness and fairness of location processing through Web & App Activity and Location History, accountability failures involving Location Accuracy and excessive retention in Web & App Activity and Location History.
The commission hasn’t released its complete decision yet. Its announcement doesn’t specify every change Google must make or divide the €403 million among the individual violations.
Location Turns an Interest Into a Place
A search can suggest intent. A store visit provides another signal.
Someone looking at running shoes may be researching a purchase, comparing prices or killing time. Location data showing that the same device later entered a sporting-goods store gives an advertising system more information to use when selecting an audience, delivering another ad or measuring the campaign.
The signal still requires interpretation. A device entering a store doesn’t prove the owner bought anything. It doesn’t prove an advertisement caused the visit. A useful measurement system needs accurate location boundaries, credible control groups and a clear method for connecting exposure with later activity.
Google operates Search, Maps, Android, websites, apps and advertising tools across that sequence. Those products give the company several opportunities to collect or use signals about intent and movement.
If users can’t tell which setting collects their location or how that information may affect advertising, turning on a feature doesn’t mean they understand the full commercial use of the data.
Google Says the Case Covers Older Practices
Google says the investigation concerns policies used between 2018 and 2020 and that its location practices have changed substantially since 2019.
The company told Reuters that users can now automatically delete personal information on a rolling schedule, store Timeline data on their devices and manage how location information is used for advertising. Google also says searches retain a general area rather than a precise device location.
Those changes matter because they can reduce how much precise location data Google keeps centrally and give users more direct control over its use.
The complete decision will provide more detail about the violations and what Google must do to comply. Until it is published, the conclusion should remain narrow: Google’s disclosures, controls and retention practices during the period investigated didn’t satisfy the GDPR.
The six-month order requires Google to demonstrate that its location-data processing now complies with the law.
The Store Visit Has Become Part of the Ad Product
Advertising companies want to know what happened after an impression appeared. Location data can help connect a television or mobile ad with a later visit to a physical business.
Infillion’s acquisition of Foursquare shows the commercial demand. Foursquare measures visits across an aggregated footprint of 250 million U.S. devices. Infillion plans to combine that capability with MediaMath’s ad delivery and Catalina’s retailer purchase data.
The companies and datasets are different. The business goal is related: give an advertiser more evidence that media spending produced activity outside the screen.
Connected television makes that especially valuable. A streaming service can report that an ad reached a household. Location information may indicate whether an exposed device later entered a store. Retailer data may show whether the advertised product sold.
Each connection requires companies to explain where the information came from, which permissions cover its use, how long it remains available and how a person can stop the processing. More precise measurement creates more records that can reveal a household’s behavior.
Google’s fine puts a number on the cost of failing those requirements at scale.
Privacy Controls Have to Govern the Advertising System
A settings page can offer an opt-in, an opt-out and an automatic deletion option. Those controls work only when the person understands which products collect the data and what Google can do with it.
The three features in this case show why that gets complicated. One setting relates to account activity. Another builds a travel history. A third improves an Android device’s location. A user may interact with them at different times and for different reasons while the resulting information supports a broader advertising and personalization system.
Compliance therefore requires more than adding another switch. Google must provide clear explanations, apply each permission to the uses it actually covers, limit retention and maintain records showing that the processing meets the law.
Advertisers and publishers also need to know which data can support targeting and measurement. A campaign result loses value if the underlying location information was collected or retained improperly. Agencies buying across several platforms inherit that risk through the data and reports they use.
The DPC’s decision applies to Google’s European processing under the GDPR. Its effect can extend beyond Europe when global products adopt common controls or advertisers demand the same documentation from other partners.
The Streaming Wars Take
Advertising platforms want to follow a campaign from the screen to the store and, eventually, to the sale. Location data supplies the middle step.
It can show that a device exposed to an ad later entered a dealership, restaurant or retailer. It can also reveal where someone goes, how often they return and what those movements suggest about their life.
Ireland found that Google failed to explain and govern that information properly across three separate settings. The €403 million penalty covers practices from 2018 through early 2020, but the six-month compliance order requires Google to prove that its current system follows the law.
The same requirement applies across connected television, mobile advertising and store-visit measurement. Every connection between an impression and a physical visit needs a documented lawful basis, a stated purpose, a retention limit and a way for people to exercise their rights.
The advertising industry wants a clearer view of what happened after the impression. Google’s fine shows the cost when the data trail is easier to build than it is to justify.
The Streaming Wars is intentionally ad-free
We don’t run display ads. Not because we can’t, but because we don’t believe in them.
They interrupt the reading experience. They cheapen the work. And they burn advertisers’ money on impressions nobody actually wants.
So we chose a different model.
We say the things people in this industry are already thinking but don’t say out loud. We connect the dots beyond the headline and focus on explaining why things matter to the people working in this business.
If you believe industry coverage can exist without clutter and interruption, you can support it here → SUPPORT TSW.
Support is optional. But it directly funds research and continued coverage — and helps prove this model can work.
Support TSW →
