Google has been fined €403 million ($650 million) by Ireland’s Data Protection Commission over the way it handled users’ location data in Europe, nearly eight years after consumer groups first raised concerns about the company’s practices.

The Irish regulator, which serves as Google’s lead privacy authority in Europe, found that the company had processed location information unlawfully and unfairly through its Web & App Activity and Location History services. It also found that Google retained some location data for too long and failed to clearly explain its practices to users.

The commission has given Google’s Irish subsidiary six months to bring its handling of location data into compliance with European Union privacy law. The fine itself requires court approval before it can be collected.

The case began in November 2018, when seven consumer organizations filed complaints coordinated by the European Consumer Organisation, known as BEUC. A Danish consumer group separately raised similar concerns with its national regulator. The groups called for an investigation, an end to unlawful uses of location data—particularly for advertising—and a penalty strong enough to deter future violations.

Ireland’s privacy commission formally opened its investigation in February 2020. It examined Google’s practices between May 25, 2018, when the EU’s General Data Protection Regulation came into effect, and February 4, 2020.

The investigation focused on several Google services. Web & App Activity could combine location information with users’ searches and browsing activity, while Location History could record and map users’ movements through Google’s Timeline feature. The regulator also examined Location Accuracy, a feature that improves Android positioning beyond GPS alone.

The commission found that Google had not adequately demonstrated that its processing of data through Location Accuracy was lawful, fair and transparent. It also said users had not been sufficiently informed about how the feature handled their information. Unlike some other location features, Location Accuracy could operate without a Google account.

Ireland’s deputy privacy commissioner, Graham Doyle, said location information could provide useful services but could also reveal highly sensitive details about people’s lives. He said users might not have understood that their whereabouts could contribute to advertising and the creation of profiles about their interests, while lengthy data retention further reduced their control over their information.

Consumer groups argued that Google’s system made it difficult for people to give meaningful consent. They said Web & App Activity was enabled by default and that important information about location collection was buried behind additional steps. Users who rejected Location History could also receive repeated prompts encouraging them to activate it.

BEUC said that selecting a useful Google feature should not amount to consenting to a broader package of tracking and advertising practices. The organization welcomed the regulator’s decision but criticized the lengthy enforcement process, saying the delay weakened the impact of privacy enforcement.

Google said the decision concerned historical practices that had since been changed. A company spokesperson pointed to measures introduced from 2019 onward, including automatic deletion options and changes to how Timeline data is stored.

Google also cited controls for personalized and location-based advertising, a centralized hub explaining its privacy practices, and changes limiting the location information retained through Web & App Activity. The company said it now generally saves an estimated area rather than precise device location for searches.

The €403 million penalty is the fourth-largest fine imposed by Ireland’s privacy regulator under the EU’s General Data Protection Regulation. The commission said three other major investigations involving Google are at an advanced stage.

Google said it intends to appeal, arguing that certain legal issues in the case require further clarification. Under Irish law, the company has 28 days after receiving notification to challenge a fine of this size in the High Court. An appeal would suspend collection of the penalty until the legal challenge is resolved.