Google hit with €403M privacy fine over handling of user location data

illuminem summarises for you the essential news of the day, reviewed by our editorial team. Read the full piece on POLITICO or enjoy below:

🗞️ Driving the news: Ireland's Data Protection Commission fined Google €403 million on Monday for infringing the EU's General Data Protection Regulation in how it gathered user location data
• It is the regulator's fourth-largest fine and its first major penalty against Google, covering four counts relating to the Web & App Activity, Location History and Location Accuracy functions, and transparency

🔭 The context: The inquiry opened in 2020 after complaints from consumer organisations across the EU alleging Google used dark patterns and unfair practices to push users into enabling location-sharing features
• Ireland enforces EU privacy law against many tech giants headquartered there, and the DPC has three further large-scale inquiries into Google under way, covering its PaLM2 AI model, personalised advertising and account sign-up process

🌍 Why it matters for corporate governance and sustainability: Data privacy is a material ESG risk for technology companies, and consent obtained through interface design rather than informed choice goes to the heart of how firms treat their users
• The six-year gap between complaint and decision is the governance question BEUC raises
• Enforcement that arrives long after practices change limits its deterrent value, however large the eventual fine

⏭️ What's next: Google says the case concerns historical policies updated from 2019 onward
• The three remaining DPC inquiries, including one into AI model data processing, will test whether enforcement against newer practices moves faster.

💬 One quote: "The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples' location data. However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement" — Agustín Reyna, Director General, BEUC

📈 One stat: €403 million — the Irish DPC's fourth-largest fine and its first major penalty against Google.

Subscribe to our free newsletters to never miss a beat in sustainability.

The world needs sustainability knowledge. At illuminem, no interest group or shareholder can influence our work. Thank you for supporting our mission to make high-quality and independent sustainability information free for all. Every contribution helps. Thank you for donating today