Alphabet Inc. (NASDAQ:GOOGL)’s Google has been hit with another major European regulatory penalty, this time over how it historically processed users’ location data. Ireland’s Data Protection Commission (DPC), the lead EU privacy regulator for many of the largest U.S. technology companies, fined Google €403 million ($463 million) after finding that the company infringed the European Union’s General Data Protection Regulation (GDPR).
DON’T MISS: Waymo is Taking Robotaxis to Tokyo. Can Alphabet Get Ahead of Uber in Japan?
The investigation covered Google’s processing of location data between 2018 and 2020 through three features: Web & App Activity, Location History, and Location Accuracy. Google says the case concerns historical policies and that it has significantly changed its location-data practices since 2019.
Let’s look at why Alphabet investors should care about this €403 million penalty, which concerns past practices.
Bull Case
Google’s strongest argument is that the practices examined by the DPC are several years old. A Google spokesperson said the company has introduced robust tools and significantly evolved how it manages location data since 2019. Among the changes, Google said users can automatically delete personal data on a rolling basis, store timeline data directly on their devices, and control how data, including location information, is used for advertising. Google also said that when users perform searches, it stores an estimated general area rather than the precise location of their devices.
READ ALSO: Apple (AAPL) Opens the Ternus Era with a Foldable iPhone. Can Premium Devices Lift Revenue?
These changes are relevant because the DPC’s findings relate specifically to Google’s practices between 2018 and 2020. The regulatory decision therefore should not automatically be read as a finding that Google’s current location-data practices are identical to those examined in the investigation. The fine also brings greater clarity to a case that has been open for years. The DPC launched its investigation in 2020 following complaints from several European consumer-rights organizations, including BEUC, the European Consumer Organisation.
Bear Case
The €403 million penalty is still substantial and ranks as the fourth-largest fine among the more than €4 billion in penalties imposed by the Irish regulator since it became the lead EU regulator for many major U.S. technology companies under GDPR. More importantly for Alphabet investors, the regulatory scrutiny is continuing, as Google remains subject to three separate statutory inquiries by the DPC, which the regulator said are at an advanced stage.
The latest decision also goes beyond the financial penalty, as the DPC ordered Google to bring its processing of location data into compliance within six months. The regulator’s concerns thus reach directly into the relationship between location data and Google’s advertising ecosystem. DPC Deputy Commissioner Graham Doyle said Google’s failures could have left individuals unaware that their location information was being used, including to influence them with advertisements or infer their interests, potentially causing them to lose control over their personal data.
The DPC found infringements involving the lawfulness and fairness of Google’s processing of location data through features including Web & App Activity and Location History. Web & App Activity processes information related to activity on Google services, while Location History tracks users’ locations through mobile devices.
Conclusion
The €403 million fine concerns practices dating back to 2018–2020, and Google says its approach to location data has changed significantly since then. That makes it important not to treat the DPC’s findings as a description of every aspect of Google’s current location-data practices. Despite that, the regulatory story is not finished, as Google has been given six months to bring its location-data processing into compliance, and three additional DPC investigations are already at an advanced stage.
For Alphabet shareholders, those unresolved inquiries are arguably more important to watch than the historical period covered by the latest fine. The €403 million penalty has now been quantified, but the outcome of Google’s remaining Irish privacy investigations has not.
READ NEXT: Can Eli Lilly Catch Novo Nordisk in the Oral GLP-1 Race? AND Abbott vs. Intuitive Surgical: Is Consistent Growth Better Than Premium Growth?
This article is originally published at Insider Monkey.
