Google infringed the General Data Protection Regulation, the EU’s landmark laws, on four counts, said Ireland’s three privacy commissioners Des Hogan, Dale Sunderland and Niamh Sweeney. The issues concerned how Google processed and retained location data in its Web & App Activity, Location History and Location Accuracy functions, as well as transparency.
The complaints from consumer groups alleged that Google had used dark patterns and unfair practices to incite users to enable features that shared their location data.
The Irish DPC has three other ongoing large-scale investigations against Google. Those are examining data processing by Google’s PaLM2 AI model, the company’s personalized advertising system, and Google’s account sign-up process.
Google spokesperson Mathilde Méchin said in a comment: “This case centers around historical policies that have since been updated. From 2019 onward, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
Agustín Reyna, director general of BEUC, said in a comment: “The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data. However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement … Consumers’ fundamental rights need to be upheld faster and better.”
This article was updated to include comments from Google and BEUC.
