403 million euros fine to Google for spying on the location of Android users without their consent

The Irish Data Protection Commission or DPC, has imposed a fine of 403 million euros on Google for repeatedly violating the privacy of Android users.

The community regulator (which acts in this case because Google is based in Ireland to pay less taxes), has carried out an investigation since 2020 after receiving several complaints from European consumer organizations, to reach the conclusion that the “Web Activity and Apps”, “Location History” and “Location Accuracy” functions, present on Android smartphones, violated data protection regulations (GPDR).

History and location accuracy features on Android were used to create business profiles in violation of the GDPR

Google has violated the principles of “legality and loyalty” in the processing of this data, systematically failing to comply with the transparency obligations it has with its users. Specifically, Google kept location records of Android users for much longer than necessaryat the same time that it prevented them from knowing what they were used for (creating illegal commercial profiles).

Google collected coordinates of its users through Wi-Fi networks and cell towers even without logging in

In the case of the “location accuracy” feature on Android, Google has collected data from WiFi networks and cell towers to know the position of userseven when no Google account was signed in.

Google alleges that these are “updated policies from the past”, however, it seems that the DPC does not think the same and has forced the company to adjust its data collection processes and reduce the time it keeps that data in its possession.

The authorities have three other advanced investigations open into other Google breaches, so this may not be the last fine. Let us remember that in the US a judge has already determined that Google is a monopoly, going so far as to recommend the division of the company.