The Irish Data Protection Commission investigated Google's processing of location data through three features: Web and App Activity, Location History, and Location Accuracy, during the GDPR application period from May 25, 2018, to February 4, 2020. The DPC found that Google failed to meet GDPR transparency and data retention requirements, processing location data without proper user consent and retaining it longer than necessary. This resulted in a €403 million fine. Google stated that it has updated its practices since 2019, including tools for managing location data and automatic deletion of older data. The DPC demands compliance within six months but has not published the full decision yet.

The impact involves violations of GDPR privacy regulations, specifically regarding user consent, transparency, and data retention of location information. Users potentially lost control over their personal location data, which could have been used for targeted advertising or profiling without adequate awareness or consent. There is no indication of a technical security vulnerability or exploitation; the issue is regulatory non-compliance with privacy laws.

Google has updated its location data processing policies and implemented mechanisms for easier user control and automatic data deletion. The DPC requires Google to bring its practices into compliance within six months. Organizations and users should review and manage location data settings accordingly. No technical patch or security fix is applicable as this is a privacy compliance issue.