Google was fined 403 million euros in September 2026 for illegally holding onto users’ location data — and the ruling puts a spotlight on three specific account settings that most people have never touched. The fine, issued by Ireland’s Data Protection Commission, isn’t just a regulatory slap. It’s a direct signal to every person with a Google account that the company’s default settings are designed to collect as much as legally possible, and sometimes more.
- Ireland’s Data Protection Commission fined Google 403 million euros on September 21, 2026, for breaching EU privacy rules.
- The inquiry examined Google’s data practices from May 2018 — when GDPR took effect — through February 2020.
- Regulators found Google processed location data unlawfully through two specific settings: Web & App Activity and Location History.
- Ireland serves as Google’s lead EU regulator because the company’s European headquarters is based in Dublin.
- The inquiry was opened six years ago, meaning accountability for these violations took half a decade to arrive.
The Three Settings Google Doesn’t Want You to Find
Web & App Activity. Location History. Ad Settings. Those are the three controls at the center of this entire mess, and they’re buried inside your Google Account behind a maze of menus designed to make disengagement feel more like effort than empowerment. Web & App Activity tracks your browsing and search behavior across Google services. Location History maps where your phone physically travels. Ad Settings determines how that combined data pool shapes the ads that follow you around the internet like a stray dog.
Google does provide a Privacy Checkup tool inside your account dashboard — the company’s engineers at its Munich privacy hub, GSEC, built it specifically to surface these controls. But a tool that exists and a tool that gets used are two entirely different things. Most people set up a Google account once and never return to its settings. Google knows this. The defaults are generous toward Google, not toward you.
Turning off Location History stops Google from building a timeline of your physical movements. Pausing Web & App Activity stops it from logging your searches and browsing. Adjusting Ad Settings stops it from using that data to personalize the ads it serves. All three are accessible at myaccount.google.com. None of them are on by default in the direction that protects your privacy.
What the Regulators Actually Found
The DPC’s ruling was specific and damning. Google did not lawfully or fairly process location data through Web & App Activity and Location History. Beyond that, regulators found Google failed to be transparent about how that data was being processed. These aren’t technicalities. Transparency and fairness are foundational GDPR obligations. Violating both, for two years, is not an oversight — it’s a policy.
The investigation covered the period between GDPR’s launch in May 2018 and February 2020. That’s nearly two years of noncompliance from a company with hundreds of privacy engineers on staff. According to India Today, the DPC opened the inquiry six years ago. Six years to reach a decision. The fine lands in 2026. The violations happened in 2018. That gap is its own kind of problem, and it belongs to the regulatory system as much as it belongs to Google.
Why the Fine Is Big and Also Not Big Enough
403 million euros sounds serious. It is also roughly 0.2% of Google’s 2025 annual revenue. Alphabet reported over $350 billion in revenue last year. The math writes its own editorial. For a company operating at that scale, a nine-figure fine is an externalized cost of doing business — already baked into the risk model long before the DPC issued its ruling.
Here’s the genuinely uncomfortable truth the tech press tends to sidestep: GDPR was supposed to change behavior, not just generate fines. When the fines are small enough to absorb without restructuring a single product decision, the law becomes a tax on bad behavior rather than a deterrent. Google’s location data practices will not fundamentally change because of this ruling unless regulators start issuing fines calibrated to actual company scale. A 2% revenue cap sounds harsh until you do the arithmetic on what 2% of Alphabet actually looks like.
This isn’t unique to Google’s privacy story. The same week this ruling dropped, the tech industry was watching Anthropic, Meta, and Nvidia navigate their own rounds of regulatory and competitive pressure. The pattern holds: rules exist, enforcement lags, fines arrive years late, companies adapt minimally.
What You Can Actually Do Right Now
Go to myaccount.google.com. Click Data & Privacy. From there, find Activity Controls and turn off Web & App Activity and Location History. Then open Ad Settings and switch off ad personalization. Each of these is a standalone decision — turning one off does not require turning off others. According to privateinternetaccess.com, if you use multiple Google accounts, you need to repeat this process for each one, because a setting disabled on one account doesn’t carry over to others you’re signed into on the same device.
If you also use Gmail and want to limit how much data Gemini’s AI features process inside your inbox, there’s a separate control under Smart Features and Personalization inside Gmail settings. Google expanded Gemini across Gmail in January 2026, and those AI tools are enabled by default for most users outside the EEA, UK, Switzerland, and Japan. That’s another layer of data processing most people never opted into consciously.
You can also use Google’s My Activity page to delete location and search history that already exists — manually, by time range, or by product type. Deleting old data doesn’t undo what was already processed, but it limits what Google holds going forward. That matters, because retention was specifically what this entire legal case was about. While lawmakers in New Mexico debated nuclear fusion policy and SpaceX moved its Super Heavy booster toward an orbital launch, the more immediate issue affecting hundreds of millions of people was sitting quietly inside a settings menu most will never open.
Google was found to have kept your data longer than the law allows — the only person who can limit what it collects next is you, and those three settings are exactly where that decision lives.
Watch the Breakdown
Sources
- How to Turn Off AI in Gmail on Desktop and Mobile — www.privateinternetaccess.com
- EU fines Google 403 million euros over location data privacy breaches — www.indiatoday.in
- Taking on Privacy & Security Engineering in Munich – Safety Centre — safety.google
