A privacy fine is not the end of a tracking case

Development dated September 21, 2026

A large privacy fine offers a clear number for a complicated dispute. It offers much less clarity about what will happen to the data next. Two European announcements on September 21 bring that distinction into focus: Ireland’s location-data decision concerning Google and the European Data Protection Board’s explanation of how fines relate to other corrective measures. Read together, they support a more demanding interpretation of enforcement: the penalty and the change in processing are separate outcomes, and neither should be treated as proof of the other. [1] [2]

The Irish Data Protection Commission announced fines totaling €403 million and an order requiring Google to bring its processing into compliance within six months. The inquiry covered Web & App Activity, Location History, and Location Accuracy between May 25, 2018 and February 4, 2020. Its findings concerned lawfulness and fairness, transparency, retention, and, for Location Accuracy, the ability to demonstrate compliance. This is a decision about specified processing during a historical period, not a fresh measurement of every Google location feature. [1]

The EDPB’s new guidance supplies a useful framework for understanding that combination of measures. Adopted for public consultation on September 17 and announced on September 21, it distinguishes measures principally intended to restore compliance from fines principally intended to deter infringements. Consultation remains open until November 13. The document concerns whether to impose a fine alongside or instead of other measures; it should not be described as a new, final schedule of penalties. [2] [3]

That distinction matters because a monetary consequence does not itself specify a technical outcome. A fine can create pressure to change, but its amount cannot tell a reader which collection pathway stopped, what happened to previously retained records, or which uses remain possible. Conversely, a product change may reduce future exposure without answering how earlier conduct should be treated. The two questions interact, but collapsing them obscures both accountability and improvement.

There are important limits to what can be concluded about this case now. The DPC says the full decision will follow. Its announcement does not provide enough detail to reconstruct the precise implementation needed to satisfy the order. Nor does the coincidence of the announcements establish that the DPC applied the newly published EDPB guidance. The connection here is analytical, not a claim about the decision’s procedural history. [1]

Product history also complicates any reading of the fine as a description of today’s system. In December 2023, Google announced that Maps Timeline would move to on-device storage, with optional encrypted cloud backup and a three-month default for automatic deletion when Location History was first enabled. Those announced changes postdate the inquiry period. They are relevant context, although the announcement alone does not establish that every finding in the later decision has been resolved. [4]

The consequential question is therefore how the remedy connects to the processing it addresses. Evidence about storage, retention, and permitted uses would illuminate a different part of the outcome from the penalty amount. For tracking systems, the endpoint worth watching is whether the identified practices actually change—and whether that change can be distinguished from a revised description of the product. A fine establishes a financial consequence. It does not, by itself, establish the resulting state of the system.