Location data has been quietly powering ad targeting and interest inference for years, and Ireland’s privacy regulator just put a price on how that happened without users realizing it.
Ireland’s Data Protection Commission fined Google Ireland Limited 403 million euros on September 21, closing an inquiry opened in February 2020 into three location-related features: Web & App Activity, Location History, and Location Accuracy. The inquiry covered the period from May 25, 2018 to February 4, 2020 and found lawfulness, fairness, and transparency failures across the features, plus retention violations. Deputy Commissioner Graham Doyle said individuals “could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.” Google must bring its processing into compliance within six months. A Google spokesperson said the company’s practices have changed substantially since the period the inquiry covered.
The fine matters to marketing leaders well beyond Google’s own balance sheet because location data sits inside more martech stacks than most teams audit directly: it feeds geofencing, store-visit attribution, and increasingly the identity graphs behind CDPs that infer interest from movement patterns rather than declared preference. A regulator explicitly naming “ads” and “interest inference” as the harm, rather than treating location as a neutral operational signal, raises the bar for how clearly any platform using location data has to disclose that use.
The original insight here is timing rather than novelty: this is the DPC’s fourth-largest GDPR fine since the regulation took effect, arriving in the same month Google is separately absorbing a major U.S. ad tech remedies ruling, which means the company is managing two distinct regulatory fronts, privacy and antitrust, that both ultimately constrain how its ad business collects and uses data. Marketing teams relying on Google’s location and personalization signals for targeting should treat this as a prompt to document their own consent basis for location use now, rather than waiting on the same consent-infrastructure fight playing out over browser-level privacy signals to force the issue.
