Location Data and the DPDP Act: What Google's €403m Fine Teaches Indian Apps

On 21 September 2026, Ireland's Data Protection Commission (DPC) fined Google €403 million over how it handled location data between May 2018 and February 2020. If your app asks users for location permission, this decision is worth ten minutes of your time, because the failures it describes map almost one-to-one onto what the DPDP Act expects of location data in India.

Below: what the DPC found, how the same facts look under the DPDP Act, 2023 and DPDP Rules, 2025, and a short audit for your own location features before May 2027.

What the DPC actually found

The inquiry began in February 2020 after complaints from European consumer groups, including BEUC. It looked at three Google features: Web & App Activity, Location History and Location Accuracy (an Android setting that pinpoints location more precisely than GPS alone).

According to the DPC and the European Data Protection Board, Google infringed GDPR Articles 5, 6, 12 and 13. In plain terms, the regulator found problems in four areas:

• Lawfulness and fairness of location processing in Web & App Activity and Location History.
• Transparency across all three features.
• Accountability, because Google could not demonstrate that Location Accuracy met the lawful, fair and transparent standard.
• Retention, because location data in two features was kept longer than necessary.

Deputy Commissioner Graham Doyle put the harm simply: people "could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests." Google has six months to bring its processing into compliance. The full decision is yet to be published.

There was no hack and no leak. Every problem came from product design: how settings were explained, what users were told, and how long data stayed on servers.

Location data under the DPDP Act: same principles, Indian wording

The DPDP Act has no separate "sensitive data" category, so a user's location is ordinary digital personal data. That does not make it low-risk. A few months of GPS pings reveal where someone lives, works, worships and seeks treatment. Here is how the DPC's four findings translate.

Notice (Section 5 and Rule 3). Before or at the time you ask for consent, you must give a notice that stands on its own, in clear and plain language, with an itemised description of the personal data and the specific purpose for each item. "We use your location to improve our services" will not pass. "We use your precise location while the app is open to show nearby stores; we do not store it after your session" is the level of detail Rule 3 points towards. Users must also be able to read the notice in English or any of the 22 languages in the Eighth Schedule to the Constitution.

Consent (Section 6). Consent has to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to data necessary for the stated purpose. A single toggle that quietly feeds both delivery tracking and ad targeting fails the "specific" test. And withdrawal has to be as easy as giving consent in the first place (Section 6(4)).

Purpose and retention (Section 8(7) and Rule 8). Once the purpose is served or consent is withdrawn, the data should be erased, along with copies held by your processors. Google's retention finding is a warning for Indian apps that log location "just in case" and never clean it up. Location logs are often the largest and least-reviewed table in an app's database.

Accountability. The Location Accuracy finding is the quiet lesson. Google was penalised for being unable to show compliance. Under the DPDP Act the burden of proving that notice was given and consent obtained sits with the Data Fiduciary (Section 6(10)). If you cannot produce consent logs and notice versions for a given user on a given date, you are in the same position.

What the penalty exposure looks like in India

Indian founders often quote the ₹250 crore ceiling, but that figure applies to failures in reasonable security safeguards. Notice and consent failures like those in the Google case would most likely fall under the Schedule's residual entry for breaching other provisions of the Act, which carries a maximum of ₹50 crore per instance. Breach-notification failures carry up to ₹200 crore.

Under Section 33, the Data Protection Board will weigh the nature, gravity and duration of the breach, the type of data affected and whether it was repetitive. Location data collected from lakhs of users over years would score badly on most of those.

A 30-minute location data audit for Indian apps

Open your app on a fresh phone and work through these questions with your product lead.

1. When do you ask for location permission? If the prompt fires on first launch, before the user has done anything that needs location, you will struggle to argue the consent was specific.
2. Foreground or background? Background location on Android and "Always" on iOS need a separate, clearly explained purpose. If you cannot name one, switch to while-in-use.
3. Precise or approximate? A food-delivery app needs precise location at checkout. A news app showing city-level weather probably does not. Collect the coarsest data that does the job.
4. Who else receives it? Check every SDK in your build. Analytics, attribution and ad SDKs often read location independently of your own code, and as the Data Fiduciary you remain responsible.
5. How long is it kept? Find the raw location table, check the oldest row, and set a deletion job.
6. Can a user turn it off in two taps? And when they do, does the backend actually stop collecting and delete what it no longer needs?
7. Can you prove it? Pull the consent record for one real user. You should see the notice version shown, the time of consent and any later withdrawal.

If any answer is "we're not sure", that is your starting point. Our DPDP compliance checklist covers notice and consent items in more detail, and a privacy impact assessment is the right tool if location tracking is central to your product.

The timing question

Notice, consent and data principal rights obligations take full effect around 13 May 2027, roughly six months from now. That is the same window the DPC gave Google, which has a global privacy team. Most Indian SMEs have one engineer who knows where the location data goes.

Serving European users too? Our GDPR compliance consulting team can align both regimes with one set of notices and consent flows.

This article is general guidance based on public information as of October 2026 and is not legal advice. For advice on your specific situation, please consult a qualified professional.

Want a second pair of eyes on your app's location flows? Start with our free DPDP checklist, or get in touch for a focused review.