#
Core lawful-basis and special-category rules are fully in force and well documented; the pseudonymisation/anonymisation sub-module lacks a directly retrieved DPC-specific source in this run.
Sub-modules (4)
Lawful BasesGreen
Article 6(1)(b) contractual-necessity basis, among the enumerated GDPR lawful bases, applies where processing is necessary for performance of, or entry into, a contract.
Claims (2):
- Processing is lawful under GDPR Article 6(1)(b) where necessary for performance of a contract to which the data subject is party, or to take steps at the data subject's request prior to entering a contract.
- Google Ireland Limited infringed: DPC's 21 Sept 2026 final decision found infringements of GDPR Arts 5, 6, 12 and 13 in location-data processing via Web & App Activity, Location History and Location Accuracy, for the period 25 May 2018 to 4 Feb 2020.
Consent ThresholdsGreen
Ireland set the Article 8 GDPR age of digital consent at 16 years, the maximum permitted under the GDPR's 13-16 range.
Claims (1):
- Ireland has set the age of digital consent under Article 8 GDPR, read with the Data Protection Act 2018, at 16 years, meaning online service providers generally cannot rely on a child's own consent below that age.
Special CategoriesAmber
The Data Protection Act 2018 created a bespoke lawful ground for processing health data necessary for insurance, pension and mortgage purposes.
Claims (1):
- The Data Protection Act 2018 introduced a lawful processing ground permitting health data to be processed where necessary for insurance, health-insurance, occupational pension, retirement annuity, or property-mortgaging purposes.
Pseudonymisation And AnonymisationRed
No DPC-specific pseudonymisation/anonymisation guidance or safe-harbour provision was retrieved in this research pass.
Absence provenance: unavailable. Searched: unavailable.
Lawful Processing & Special Data
The Data Protection Commission's final decision of 21 September 2026 found that Google Ireland Limited infringed the GDPR in its processing of users' location data through the Web & App Activity, Location History and Location Accuracy features. The decision relied on several provisions of the GDPR, including Article 5, Article 6, Article 12 and Article 13, addressing the lawfulness and fairness of the processing, the lawful basis relied upon, and the transparency obligations owed to data subjects, for the period from 25 May 2018 to 4 February 2020. The Commission's own full published decision text, including its complete legal reasoning, was not independently retrieved this cycle; the Article references above are sourced from secondary legal commentary summarising the decision rather than from the Commission's own text directly.
The Commission's finding that Google infringed the GDPR by processing location data unlawfully and unfairly is a significant application of the Article 5 fairness and lawfulness principles and the Article 6 lawful-basis requirement to a major technology company's default data-collection features, rather than to a discrete, opt-in processing activity. The involvement of Article 12 and Article 13 findings additionally points to transparency deficiencies in how the relevant location-data features were presented to users during the covered period.
Outlook
The underlying lawful-processing findings remain subject to the fine's own confirmation process: the fine requires confirmation by the Irish High Court, and an appeal from Google is considered likely. Until that process concludes, the Article 5, 6, 12 and 13 findings described above stand as the Commission's own determination but are not yet settled as a final matter of Irish law. The six-month corrective compliance order, with compliance due 21 March 2027, creates a separate, more immediate timeline for Google to adjust the underlying processing practices regardless of how the confirmation and appeal process proceeds.
1 earlier distinct update(s)
Lawful Processing & Special Data
The DPC's 21 September 2026 decision against Google Ireland Limited found infringements of GDPR Articles 5, 6, 12 and 13 in respect of the lawfulness, fairness and transparency of location-data processing carried out through Web & App Activity, Location History and Location Accuracy features. Article 5 sets out the core processing principles, Article 6 the lawful bases for processing, and Articles 12 and 13 the transparency obligations owed to data subjects at the point personal data is collected. The DPC's finding that these provisions were infringed concerns whether Google gave users an adequate legal basis and adequate transparency for processing their location data through these specific product features. The inquiry that produced this finding was opened in February 2020 and ran for approximately six and a half years before conclusion in September 2026, reflecting the scale and complexity of establishing infringement across multiple interlinked product features.
This finding sits within Ireland's broader enforcement context this cycle: the DPC's decision explicitly targets the lawful-basis and transparency dimensions of location processing, rather than, for example, a security or retention failure. The EUR403 million fine and accompanying six-month compliance order reflect a finding of substantive infringement on the lawfulness and transparency principles specifically.
Outlook
Whether Google intends to appeal the 21 September 2026 decision is understood from press reporting but has not been confirmed against a DPC or court filing this cycle. Any appeal would test the DPC's Article 5/6/12/13 findings on location-data lawfulness and transparency before the courts, and would be the clearest next signal for how durable this finding proves to be.
Sources and claims (4)
- ProbableData Protection Commission — Processing is lawful under GDPR Article 6(1)(b) where necessary for performance of a contract to which the data subject is party, or to take steps at the data subject's request prior to entering a contract.observed
- ProbableData Protection Commission — Ireland has set the age of digital consent under Article 8 GDPR, read with the Data Protection Act 2018, at 16 years, meaning online service providers generally cannot rely on a child's own consent below that age.observed
- ProbableDataGuidance — The Data Protection Act 2018 introduced a lawful processing ground permitting health data to be processed where necessary for insurance, health-insurance, occupational pension, retirement annuity, or property-mortgaging purposes.observed
- Probableunavailable — Google Ireland Limited infringed: DPC's 21 Sept 2026 final decision found infringements of GDPR Arts 5, 6, 12 and 13 in location-data processing via Web & App Activity, Location History and Location Accuracy, for the period 25 May 2018 to 4 Feb 2020.