Google Was Fined €403 Million Over Location Data: Turn These 3 Off

Why was Google fined €403 million?

On 21 September 2026, Ireland's Data Protection Commission closed a six-year investigation into how Google handled location data. The finding: Google processed people's location data unlawfully and unfairly through three account features — Web & App Activity, Location History and Location Accuracy — during the period the inquiry examined, May 2018 to 4 February 2020.

The fine was €403 million, the fourth largest the Irish regulator has ever issued. Google has six months to bring its processing into line.

Here's the part worth sitting with. This wasn't a breach. Nobody broke in. Nothing was stolen. The regulator's point was that users could be unaware their location was feeding ad targeting and interest inference — and so they lost control of their own personal data. The harm wasn't that a criminal got hold of where you'd been. It was that the company you gave it to used it in ways you'd never been clearly told about.

What does this mean for you?

Most people have never opened any of these three settings. They were switched on during a phone setup years ago, probably with a tap on "Accept" somewhere between choosing a wallpaper and restoring your contacts.

Location data is unusually revealing. A few weeks of it shows where you sleep, where you work, which doctor you see, which school you drop the kids at, and where you go on a Saturday night. Turn that into a profile and it becomes a set of "interests" — which is exactly what the regulator said was happening. Your movements became a marketing file.

The Irish decision applies under European law, but Australians shouldn't treat it as someone else's problem. The draft Tranche 2 reforms to the Privacy Act, released for consultation on 31 August 2026, include a proposed "fair and reasonable" test on how organisations collect personal information — the same basic idea the Irish regulator applied here. That Bill hasn't been tabled yet and has no start date, so for now the practical protection is the one you apply yourself.

Why you can't just ask what they know

It took a national regulator six years to reach a finding on how location data was used between 2018 and 2020. That's the scale of effort it takes to get a straight answer out of a large platform.

Compare that with the public sector. A government agency is generally required by law to hand over the records it holds about you when you ask. A private company, and especially the data brokers and ad-tech firms downstream of it, isn't under the same practical pressure — and in most cases won't volunteer anything. You can download a copy of your own account data from Google, and it's worth doing once just to see it. But the inferences drawn from that data, and where they travelled, are much harder to pin down.

For privacy-minded people, the takeaway is simple. Don't wait for a regulator to tidy this up. Stop generating the data in the first place.

How to turn off Google location tracking (step by step)

Google moves menus around regularly and sometimes renames features — Location History, for example, is called Timeline on many newer phones. So the steps below describe where to look rather than every tap. If a label doesn't match exactly, search your Google Account settings for the feature's name.

You'll do most of this in one place: Activity Controls, inside your Google Account under "Data & privacy". On Android, you can get there through the Settings app (look for Google, then "Manage your Google Account"). On an iPhone, open the Google app or any Google app's profile menu, or simply go to myaccount.google.com in your browser. On a computer, sign in at myaccount.google.com. The settings sync across devices, so doing it once covers your account — the device-level Location Accuracy switch is the exception.

1. Open your Google Account and go to "Data & privacy", then find the history or Activity Controls settings.
2. Open Web & App Activity and turn it off. If you'd rather keep it on, at least untick the option that includes activity from Chrome and apps that use Google services.
3. While you're there, set auto-delete for Web & App Activity to the shortest period offered (commonly 3 months), so anything collected in future expires.
4. Open Location History (or Timeline) and turn it off for your account and for every device listed under it. Then choose the option to delete existing history, or set auto-delete if you want to keep some.
5. Go to My Activity (myactivity.google.com), choose Delete, and select "All time" to clear stored Web & App Activity. Take a moment to check nothing you need is in there first.
6. On Android, open the Settings app, go to Location, then Location services, and turn off Google Location Accuracy. Your phone will still find you with GPS; it just won't send Wi-Fi and Bluetooth scans to Google to improve its estimate.
7. On any phone, review which apps are allowed to use your location (Android: Settings, then Location, then App location permissions; iPhone: Settings, then Privacy & Security, then Location Services). Set most to "Never" or "While using", and turn off precise location for apps that don't need it.
8. Put a reminder in your calendar to check these settings again in six months. Updates have a habit of asking you to switch things back on.

Turning these off doesn't stop Google seeing your location entirely. Your IP address still gives a rough area, and individual Google apps such as Maps may ask for location while you use them. The goal is to stop a permanent, ad-linked history building up in the background.

Should you rely less on Google altogether?

Switching off three settings is a good start, but it's worth noticing how much of your life still sits inside one account. Your search history, your maps, your photos, your calendar and, for many people, your email all tie back to the same login. Each service is a separate stream of signals, and one company holds all of them.

You don't have to leave in one go. The easiest place to start is often email, because it's the account everything else resets through. An end-to-end encrypted provider — ideally based outside the Five Eyes, where the provider itself can't read your messages — takes one big stream out of the pool. We maintain a separate site, NoSpyEmail, that compares the private email providers that stand up to that kind of scrutiny, if you want somewhere to start.

For the rest of your browsing, a few free tools help without any account at all. uBlock Origin is a free, open-source content blocker that stops a lot of the tracking scripts on the web. A privacy-focused search engine as your default takes your searches out of your ad profile. And JustDeleteMe lists how to delete accounts on hundreds of services, including the old ones you forgot were linked to your Google login.

Compare private email providers at NoSpyEmail →

Where to complain if you think your data was misused

If you're in Australia and think an organisation has mishandled your personal information, the usual path is to complain to the organisation first, then to the Office of the Australian Information Commissioner (OAIC) if you're not satisfied. In the UK, it's the Information Commissioner's Office (ICO). In the EU, it's your national data protection authority — for Google's European operations, the lead regulator is the Irish Data Protection Commission that issued this fine.

We won't pretend it's quick. As this case shows, a single inquiry can take years. But complaints are what trigger these investigations in the first place, and each one adds to the record regulators rely on.

What to do this week

Set aside ten minutes. Turn off Web & App Activity and Location History, set auto-delete, clear what's stored, and switch off Location Accuracy on your Android phone if you have one. Then check your app location permissions.

None of this undoes what's already been inferred about you. But it stops the file growing, and the file is the whole business model. The €403 million fine says a regulator agreed that you should have been asked properly. You can give yourself the answer you should have been asked for.