If you’ve ever checked a restaurant review “near me,” used Maps to beat traffic, or just carried an Android phone around, you’ve probably shared location signals with Google. Ireland’s Data Protection Commission (DPC) just hit Google with a €403M fine tied to how it processed and kept location data during the early GDPR years (May 2018 to Feb 2020) . This isn’t abstract. Location data can quietly shape what ads you see and what gets inferred about your routines, and the DPC’s point was simple: people may not have had clear control . Let’s break down what the DPC said went wrong, what these settings can reveal, what Google says it changed, and what you can do in 15 minutes to tighten this up.
What the DPC says happened (and why €403M is the headline)
The headline number—€403 million—comes from Ireland’s Data Protection Commission (DPC), which leads GDPR enforcement for many big tech companies with EU headquarters in Ireland. In this case, the DPC says Google broke GDPR rules in how it handled location data during the early GDPR period: May 25, 2018 through February 4, 2020 .
The trigger matters. The DPC says it opened the inquiry in February 2020 after getting complaints from consumer rights groups . And it didn’t look at “Google location tracking” as one giant thing. It focused on three specific features that, in normal day-to-day phone use, can quietly build a location trail:
- Web & App Activity
- Location History
- Location Accuracy
What the DPC’s core claims boil down to
The DPC’s findings (as reported so far) hit three themes:
- GDPR requirements weren’t met for some processing
The DPC says Google processed location data via Web & App Activity and Location History “without meeting the GDPR’s requirements” .
- Google didn’t show compliance for another part
For Location Accuracy, the DPC says Google “failed to demonstrate compliance with GDPR principles” while processing personal data through that feature .
- Transparency + retention problems across the board
The DPC alleges Google didn’t meet transparency obligations for all three features, and that it kept location data collected via Web & App Activity and Location History longer than necessary .
That last part is where this gets personal. Regulators don’t just care that location data exists. They care about loss of control—people not realizing what’s being collected, how it’s used, or how long it sticks around. DPC Deputy Commissioner Graham Doyle put it bluntly: people “could have been unaware” their location was being used to influence them with ads or infer their interests, and that longer retention “aggravated this loss of control” .
Why this case doesn’t feel “edge-case”
If you’ve ever:
- left default settings alone during Android setup,
- signed into Chrome or YouTube,
- used Maps for traffic, parking, or “near me” searches,
…you’ve done “normal” things that can generate location signals. The DPC’s point is that normal behavior shouldn’t turn into a long-running location dossier without clear, understandable choices.
To cap it off, the DPC also ordered Google to bring its processing into compliance within six months —which is a strong hint that regulators see this as a settings-and-controls problem, not just a paperwork problem.
Three settings, three ways your location gets captured or inferred
If you want to understand “Google location data,” stop thinking about a single on/off switch. The DPC focused on three separate settings/features because they collect location in different ways—and it’s easy to misunderstand what you’ve actually allowed.
1) Web & App Activity: location as a side effect of “using Google”
Web & App Activity is a Google Account setting that lets Google process what you do across its services—think searches, app usage, browsing-related activity—and it can include location data as part of that activity trail .
Why people miss it: the name sounds like “product improvement” or “history,” not “location tracking.” If you’re signed in and using Google services, this setting can feel like background noise you never explicitly opted into for location.
What it can reveal:
- A pattern of where you were when you searched, watched, scrolled, or opened an app
- Repeat “general area” signals that still map to routines over time
Google has also said it does not save precise device location in Web & App Activity, but an “estimated general area” . Even that can be plenty to infer habits.
2) Location History: the most obvious “timeline of your life”
Location History is an opt-in service that tracks users carrying compatible mobile devices and can infer visited places, activities, and routes . It shows up as a private Google Maps Timeline .
Why people miss it: many people remember toggling it once (or don’t remember at all), then forget it keeps building a record—even when you’re not actively using a Google service .
What it can reveal:
- Frequent stops (home/work patterns are the classic example)
- Routes and regular travel windows
- Inferred activities based on movement patterns
3) Location Accuracy: your phone’s “extra sensors” mode (account or no account)
Location Accuracy is an Android feature that helps the device figure out where it is more accurately than GPS alone . It’s also notable because it’s available even without a Google Account .
Why people miss it: it sounds like a technical quality setting, not a data setting. People think “accuracy” is just a better dot on the map.
What it can involve:
- Combining signals beyond GPS (the whole point is “more than GPS alone”)
- More consistent location determination indoors and in dense areas
How this ties back to the DPC’s concerns (without the legal fog)
The DPC’s concern wasn’t that these features exist. It was about how they were explained and governed during the period reviewed:
- Web & App Activity + Location History: the DPC said Google processed location data without meeting GDPR requirements
- Location Accuracy: the DPC said Google didn’t demonstrate compliance with GDPR principles
- All three: the DPC alleged transparency issues
The key takeaway: you can shut off one setting and still leak location through another—because they were built for different jobs, and they don’t read like they belong to the same “location tracking” bucket.
The two problems that keep showing up: clarity and retention
Once you see location collection as a set of toggles (not one master switch), the DPC’s objections start to look less “legal” and more… human. People can’t control what they can’t properly understand. And they can’t undo what’s been kept for years.
1) Clarity (GDPR “transparency”) is about real-world understanding
Transparency sounds boring until you translate it: does the setting tell you what it’s really doing, in a way a normal person can act on?
When a control is vague, split across multiple screens, or described like a harmless feature upgrade, you don’t get a clean yes/no choice. You get a shrug-and-continue.
The DPC’s framing is blunt. It warned that people “could have been unaware” their location was being used “to, for example, influence them with ads or to infer their interests,” and that they “could lose control over their personal data” .
That’s the heart of a lot of GDPR location data fights:
- Unaware isn’t the same as “I agreed.”
- Control isn’t the same as “there’s a page somewhere with toggles.”
- “Influence ads” and “infer interests” is the point where location stops being a dot on a map and starts becoming a profile .
2) Retention is the “storage closet” problem
Picture a storage closet in your house. Storing one box for a week is normal. Storing the same box for years changes the risk. It gets copied, forgotten, and eventually opened by someone who shouldn’t be there.
That’s basically GDPR’s storage limitation idea: even if data collection had a reason, keeping it longer than necessary expands the blast radius.
Here, the DPC alleges Google retained location data collected via these features longer than necessary . And it connects retention directly to user harm: “The retention of users’ location data for longer than necessary aggravated this loss of control.”
What longer retention changes in practice:
- It turns one-off location signals into a pattern
- It makes old data easier to reuse for new purposes
- It increases what can be inferred about routines, even if you’ve “fixed” your settings today
Put simply: clarity decides whether you gave meaningful permission. Retention decides how long you keep paying for that decision.
What Google says it changed (and what to check on your own account)
After a case like this, the most useful question isn’t “who’s right?” It’s “what’s true on my phone and my Google Account right now?”
Google’s response has been that the DPC fine is about historical policies and that it has since updated practices and rolled out simpler location-data controls . Google also says it does not save precise device location in Web & App Activity, but an “estimated general area” instead .
It also points to concrete changes in how you can manage (and reduce) stored location data:
- Auto-delete controls so you can set a time window for automatic deletion
- Google Maps Timeline stored on-device, with older data removed automatically (reported as older than three months)
That’s the “what Google says.” Now the part that matters: what you can verify in a few minutes.
Quick check: three places to look (and what you’re deciding)
- Web & App Activity (Google Account)
What you’re deciding: do you want Google saving a cross-service activity log that can include location signals?
Checklist:
- Confirm whether Web & App Activity is On or Off
- If it’s On, look for:
- Auto-delete (pick the shortest window you can live with)
- Any sub-options that expand what gets saved (read the text, don’t trust the label)
- Location History / Maps Timeline (Google Account)
What you’re deciding: do you want a personal location log that can reconstruct where you’ve been?
Checklist:
- Check whether Location History is enabled
- Open Maps Timeline and verify:
- Whether Timeline is stored on your device (if available for your setup)
- Whether older data is being auto-removed
- Whether auto-delete is set to a short window
- Location Accuracy (Android device setting)
What you’re deciding: do you want the phone using extra signals to refine location beyond GPS?
Checklist:
- Find Location Accuracy (or similarly named option) and decide if you need it day-to-day
- If you don’t rely on high-precision features, turning it off can reduce how much fine-grained positioning is produced in the first place
A “set it and forget it” baseline that doesn’t break your phone
If you don’t want to babysit settings, pick a baseline you’ll actually stick with:
- Turn on auto-delete wherever it’s offered, and choose the shortest retention window you’re comfortable with
- Keep only the location features you actively use (Maps navigation is a “yes”; background history for nostalgia is often a “no”)
- Re-check after big Android/Google app updates—settings screens and defaults change more often than people notice
The point isn’t to make your phone useless. It’s to stop accidental long-term storage from becoming your default.
What this means for you: reduce spillover without breaking your phone
The DPC’s language makes one thing clear: location data isn’t just coordinates. It can be used to “influence” you with ads and “infer” your interests 【】. That’s why “I’m fine sharing my location for Maps” can quietly turn into “my routines are being modeled.”
The practical goal isn’t zero data. It’s minimum necessary data, kept for the shortest time.
Keep the utility, cut the spillover
Use these as defaults, then loosen only if you miss a feature.
- Treat location like a “while using the app” permission
- For navigation, weather, ride-share: allow location only while using the app (when possible).
- Avoid always-on access unless the app truly needs it (most don’t).
- Shorten the lifespan of what’s already being stored
Google says it has expanded tools like auto-delete controls and shifted Maps Timeline to on-device storage with older data automatically removed (reported as older than three months) 【】. Use that momentum in your favor:
- Turn on auto-delete wherever it’s available.
- Pick the shortest window you can live with.
- Be honest about “accuracy”
Android’s Location Accuracy exists to make positioning more accurate than GPS alone 【】. That’s useful in cities and indoors. It’s also extra signal collection by design.
- If you rarely need ultra-precise location, consider switching it off and see if your day actually changes.
The identity “join-key” problem (where tools like Cloaked fit)
Here’s the part most people miss: location data becomes more powerful when it’s tied to a stable identity—your real email, real phone number, and a long-lived account.
Even if you tighten location settings, you can still reduce spillover by limiting how often your real identifiers become the permanent link across apps and services. That’s where Cloaked is relevant: it lets you use masked emails and phone numbers for signups, so your everyday accounts don’t always share the same join-key that connects activity back to you.
A simple rule that works:
- If an app doesn’t genuinely need your real number or primary email, don’t hand it over.
- Save your real identifiers for banking, healthcare, and the few services where recovery and trust matter.
This approach keeps your phone useful, keeps Maps working, and trims the long-term profile that can be built from “normal” behavior.
