Compiled BY, Malami Haruna Dogondaji
21 September, 2026
No hackers were involved. The fine is about how Google handled people’s location, and any app can make the same mistakes.
On Monday, Ireland’s data protection regulator fined Google €403 million (about $463 million) after an inquiry into how the company processes location data. Nobody stole a database. The regulator asked a simpler question: did people really understand how their location was being used?
If you build apps, run a delivery service, or manage a fintech product, this case is for you. A company can break data-protection law even when its systems are never attacked.
The short version -Ireland’s regulator fined Google €403 million on 21 September 2026 for how it handled location data.No hack or theft was involved. The problems were unclear information for users, unclear permission, and keeping data for too long.The same mistakes can happen in any app. African startups can face this risk under EU law if they serve people in Europe, and under their own national laws.The fix is simple to say and harder to do: collect less, explain clearly, delete sooner, and give users real control.
Words to know
| Data protection regulator | A government body that checks how companies use personal data. |
| GDPR | The European Union’s data-protection law. It stands for General Data Protection Regulation. |
| Data controller | The company that decides why and how personal data is used. |
| Retention | How long a company keeps data. |
| Consent | A person’s clear permission to use their data. |
| SDK | A ready-made piece of software that developers add to an app. Many SDKs collect data on their own. |
What the regulator found
Ireland’s Data Protection Commission (DPC) leads on Google in the EU. The regulator said Google users could have been unaware that their location was being used to show them ads or to guess their interests. That meant they could lose control over their personal data. The DPC also said that keeping location data longer than necessary made this loss of control worse.
The inquiry looked at three Google settings: “web and app activity”, “location history” and “location accuracy”. It covered the period from 25 May 2018 to 4 February 2020.
The case began after complaints. Several European consumer rights groups complained about how Google processed location data, and the DPC started its inquiry about six years ago. The regulator has ordered Google to bring its processing into line with the law within six months.
Timeline of the case
- 25 May 2018: The period examined by the inquiry begins. This is also the day GDPR rules began to apply.
- 4 February 2020: The period examined ends. The DPC announces its inquiry after complaints from European consumer groups.
- 21 September 2026: The DPC announces the €403 million fine and orders Google to comply within six months.
Google’s answer is that the case is about older policies that have since been updated. The DPC says this is the fourth-largest fine it has issued since GDPR began.
Why location data is so sensitive
Your location tells a story about you. It can show:
- Where you live and work
- Which church, mosque or clinic you visit
- Which meetings or protests you attend
- Who you meet often
- Your daily routine
- Where a vulnerable person, such as a child, can be found
A company does not need your name to learn all this. A trail of GPS points is often enough to identify a person.
Data breach or data violation? The difference matters
Many people hear “data breach” and think of hackers. That is one kind of problem. This case shows another kind: a company misuses data, or fails to explain its use of data, even though no outsider ever got in.
Four ways a startup can get into trouble without a hack
| Risk | How it happens | Example for a startup |
| Collecting without a valid reason | The company has no good legal basis for the data it takes. | A ride app records GPS all day, even when no ride is booked. |
| Weak consent | Permission is hidden, bundled or hard to withdraw. | A user taps “Accept” on long terms and never learns their location will be used for ads. |
| Poor transparency | Privacy notices are full of legal language. | An app never says who receives location data or how long it keeps it. |
| Keeping data too long | Data stays forever with no clear purpose. | A food-delivery app keeps exact routes years after the order. |
The last risk connects to security. Every extra month you keep sensitive data is another month it can be stolen. If hackers do attack one day, a company that kept less data loses less. So privacy and security are two parts of one job.
Five lessons for African startups
1. Know where your data comes from and where it goes.
Write down what you collect, why you need it, where you store it, who can see it, and when you delete it. Include data collected by SDKs, analytics tools, ad tools and payment providers. Many teams know what their own servers collect but forget what third-party code sends out automatically.
2. Separate “must have” data from “nice to have” data.
A ride-hailing app needs a passenger’s live location during a trip. That does not give it the right to keep every trip location for years or sell targeting to advertisers. Ask your team one question: If we stopped collecting this, would the main service fail? If the answer is no, think again about collecting it.
3. Make consent clear and specific.
Do not hide it inside long terms and conditions. Tell users, in plain words:
- What you collect
- Why you collect it
- Whether you share it
- How long you keep it
- How they can withdraw permission
Avoid pre-ticked boxes. Avoid a big, bright “Accept all” button next to a tiny, grey privacy option. Also remember that consent is not always the right legal basis. Each use of data needs its own valid reason.
4. Design privacy settings for ordinary phone users.
A user should not need five menus to switch off tracking. Good practice includes:
- Location is off by default when it is not essential
- Separate switches for the service itself, analytics and advertising
- A visible sign when location is in use
- A simple way to take permission back
- A record of when and how permission was given
5. Collect less precise data and keep it for less time.
You may not need exact coordinates. An approximate area may be enough. Set clear deletion rules too:
- Live location: keep only while the transaction is running
- Delivery address: keep only as long as needed for delivery, support and legal accounting
- Old, unused location data: delete after a fixed period
A rule like “we keep everything forever” is very hard to defend.
Does this affect you if you are not in Europe?
Possibly. GDPR can apply to a company outside Europe if it offers services to people in the European Economic Area or monitors their behaviour there. A Nigerian app with European users can fall under it.
Your home law matters too, and Nigeria is already enforcing its own. The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission (NDPC). For companies classed as “of major importance”, the maximum fine is ₦10 million or 2% of annual gross revenue, whichever is higher. The rules also require you to tell the NDPC within 72 hours of learning about a personal data breach that is likely to put people’s rights at risk.
| The NDPC has acted against large companies: In a case that echoes the Google story, the NDPC fined Meta $32.8 million in February 2025 after a complaint that it ran behavioural advertising without users’ explicit consent. Meta settled the dispute out of court in November 2025.The NDPC also reportedly fined Fidelity Bank ₦555.8 million in 2024, the largest NDPC fine at that time.It fined Multichoice Nigeria ₦766.2 million. |
New rules add more duties. The 2025 implementation directive requires companies of major importance to register, appoint data protection officers and carry out data protection impact assessments. Other African countries, such as Kenya, South Africa and Ghana, have their own laws. Following one country’s law does not automatically satisfy another’s. Keep a simple register showing:
- The countries where your users live
- The law that applies in each market
- Whether you act as controller or processor
- How you transfer data across borders
- How you handle requests to access, correct or delete data
- Your steps for reporting a breach
A 10-point check founders can start today
- List all personal data your product collects.
- Find every source, including SDKs and third-party tools.
- Write down the purpose and legal basis for each type of data.
- Delete data you do not need.
- Use approximate location instead of exact location where you can.
- Review every consent screen and privacy notice.
- Test whether an ordinary user can withdraw permission easily.
- Set automatic deletion or anonymisation rules.
- Check vendor contracts and cloud-provider access.
- Run a privacy impact assessment before launching any high-risk feature.
High-risk features include constant tracking, face recognition, financial profiling, health apps, services for children, staff monitoring, and anything that joins location with identity or payment data.
Questions for boards and investors
- What is the most sensitive data we hold?
- Can we explain our data use on one page?
- Which vendors receive customer data?
- Do we know exactly when data is deleted?
- Have real users tested our consent screens?
- Can we answer a regulator or an affected customer quickly?
- Would our business survive if one type of data collection were banned?
- Does our growth plan depend on using data in ways users do not expect?
Do not wait for a knock on the door
Regulators can take years. The Irish inquiry began in 2020, and the fine came in 2026. A company that has heard nothing from regulators has not been cleared. Decisions like this can also be challenged, so check for updates as the case develops.
Fact table
| Item | Detail |
| Who was fined | Google (Google Ireland) |
| Who fined it | Ireland’s Data Protection Commission (DPC) |
| Amount | €403 million (about $463 million) |
| Announced | Monday, 21 September 2026 |
| Law used | EU General Data Protection Regulation (GDPR) |
| Period examined | 25 May 2018 to 4 February 2020 |
| Google settings reviewed | Web and app activity, location history, location accuracy |
| Main findings | Failures on lawfulness, fairness and transparency, plus keeping data too long |
| Order to Google | Comply within six months |
| Google’s response | The case concerns older policies that have been updated |
| Ranking | Fourth-largest DPC fine under GDPR |
| Type of case | Unlawful or unclear data use, not a hacking incident |
| Nigeria’s rule | NDPA 2023, enforced by the NDPC; breach reports due within 72 hours |
| Maximum NDPA fine (major companies) | ₦10 million or 2% of annual gross revenue, whichever is higher |
What to do now Small checks this week can save you a large problem later. Founder or product manager Open your app as a new user. Count the taps needed to switch off location tracking, and read every screen where you ask for permission. If a friend who does not work in tech would not understand it, rewrite it. Developer List every SDK in your app and check what each one collects. Remove any you cannot justify. Investor or board member Ask your portfolio companies the questions above at your next meeting. Everyone Check your own phone. Look at which apps have location access and set the ones that do not need it to “off” or “only while using”. Share this article with one person who builds or runs a digital product.
Sources and further reading
- RTÉ: Google fined €403m by data watchdog for location tracking
- TheJournal.ie: Google fined over €400m by Irish data watchdog over location data processing
- Limerick Leader: Google fined 400 million euro for GDPR breach
- Reuters report on the fine (syndicated): Irish regulator fines Google €403 million over location data processing
- allAfrica: Meta settles the $32.8 million fine dispute with the Nigerian government
- Infusion Lawyers: NDPC’s ₦555.8 million fine against Fidelity Bank
- Secure Privacy: Nigeria Data Protection Law compliance guide
- Planet Web: The Nigeria Data Protection Commission: powers and fines
- The Economic Times Nigeria: Businesses face up to N10m fine as NDPC tightens data protection audit enforcement
Call To Action
This article was checked against reports published on 21 September 2026. It gives general information that should not be mistaken as legal advice. Speak to a qualified lawyer about your own company.
