Loading story…
Ireland’s Data Protection Commission (DPC) has imposed a €403 million ($463 million) fine on Google for GDPR violations in its processing and retention of users’ location data. The investigation examined the company’s Web & App Activity, Location History, and Android Location Accuracy features between May 25, 2018, and February 4, 2020, finding shortcomings involving lawfulness, fairness, transparency, accountability, and retention practices.
The DPC ordered Google to make its location-data processing compliant within six months. Google said the ruling concerns historical practices that it has since changed, citing stronger user controls, automatic deletion settings, and device-based storage of Google Maps Timeline data.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Ireland's Data Protection Commission opened an own-volition inquiry following complaints from European consumer-rights organizations, examining Google's location-data processing features.
Google said it began updating the historical practices and policies at issue in 2019, including adding easier location-data management controls, automatic deletion options, and device-based storage for Maps Timeline data.
The DPC fined Google €403 million for GDPR violations involving Web & App Activity, Location History, and Location Accuracy, citing deficiencies in lawfulness, fairness, transparency, accountability, and retention. It ordered Google to bring its location-data processing into compliance within six months.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceinfosecurity-magazine.com
Open sourceabcnews.com
Open sourcehelpnetsecurity.com
Open sourcedataprotection.ie
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Regulators and courts continued to impose and update financial consequences for privacy violations across major regimes. In the EU, GDPR enforcement remained significant, with cumulative fines since 2018 reaching **€7.1B** and annual totals around **€1.2B**, while Ireland’s Data Protection Commission continued to lead enforcement totals due to the EU headquarters of major US tech firms; notable penalties cited include **€1.2B** against **Meta Platforms Ireland Ltd.** and **€530M** against **TikTok** for alleged transfers of EU user data to China. In the US, Apple began issuing payments under a **$95M** settlement tied to allegations that **Siri** captured private conversations and that data was used for advertising, with per-device payouts reported as variable and capped (up to five devices per claimant). Separately, the US Department of Health and Human Services’ Office for Civil Rights implemented an inflation-based increase to **HIPAA** civil monetary penalties effective immediately, updating tiered per-violation minimums and maximums and noting the adjustment was applied later than the statutory schedule required under the federal inflation adjustment framework.
Jun 29, 2026A court has ordered Google to pay $425 million in a class action lawsuit for misleading users about its 'Web & App Activity' privacy setting. Despite users disabling data collection, Google continued to gather app usage data via Firebase, affecting 98 million users. Google plans to appeal the decision, maintaining that its privacy tools are transparent and effective.
Jun 29, 2026
Ireland’s Data Protection Commission (DPC) fined the Health Service Executive (HSE) **€645,000** after unauthorised individuals accessed paper medical records stored at the disused St. Loman’s Hospital in Mullingar and St. Conal’s Hospital in Letterkenny. The investigation began after the HSE reported two breaches in October and November 2023; videos posted to social media by intruders revealed the records held at the sites. The DPC found that the HSE failed to provide adequate physical security for external document-storage facilities and to preserve the integrity of the archived records. Alongside the financial penalty, imposed on 28 August 2026, the regulator issued a reprimand and ordered the HSE to implement compliance measures and communicate details of the breaches as required.
Sep 5, 2026