Ireland’s Data Protection Commission (DPC), acting for the European Union, fined Google €403 million on Monday for misusing users’ location data and ordered the company to bring its processing in line with the General Data Protection Regulation (GDPR) within six months.

The regulator found that Google infringed the GDPR between May 2018 and February 2020 in its Web & App Activity, Location History and Location Accuracy functions, on lawfulness, fairness, transparency and retention. It is the fourth-largest fine imposed by the Irish authority and its first major penalty against Google; the inquiry opened in February 2020 after complaints from consumer organisations in eight European countries, brought together by the European Consumer Organisation (BEUC). Google said the case centres on historical policies that have since been updated. The same day marked the deadline the European Commission gave Google to comply with its €890 million decision under the Digital Markets Act (DMA).