Google Fined Rp7.3 Trillion: Location Tracking Continues Even When the Feature Is Turned Off

Google must accept a legal consequence in the form of a €403 million fine (around Rp7.3 trillion) from the Irish Data Protection Commission (DPC) after a six-year investigation uncovered location data collection practices that took place without users' knowledge. The sanction is the latest blow for the technology giant in Europe, and it underscores that an "off" button on a privacy feature does not always mean full protection.

The DPC investigation, covering the period from May 2018 to February 2020, concluded that Google violated European Union privacy law by failing to provide adequate information about how location data was collected and used. Regulators judged that location data is not merely a set of coordinates, but an entry point for inferring a person's interests, habits, and movement patterns—information that was then used to target advertising.

The core of the problem lies in the architecture of Google's settings. The company allowed users to turn off Location History, but the separate Web & App Activity feature could still store location information. Because the two settings were not linked, many users believed they had stopped tracking even though their data was still being stored through another channel. The finding was first reported by the Associated Press in 2018 and confirmed by Princeton University researchers.

The trail of sanctions against Google in the United States shows a similar pattern. In October 2022, the company paid US$85 million to Arizona, followed by a US$392 million settlement with 40 states the following month. The District of Columbia received US$9.5 million in December 2022, Washington State US$39.9 million in 2023, and Texas US$1.38 billion in May 2025. A separate class action lawsuit even produced a jury verdict worth US$425 million last September.

Google said it had revised its practices since 2019 and introduced tools that give users greater control over location data. The company also changed Timeline in December 2023 so that data is stored on users' devices, and cut the default retention period for Location History from 18 months to three months.

Nevertheless, the DPC stressed that the fine is not the end of the matter. The regulator requires Google to align its location data processing with European rules within six months. The full decision will be published later. For Google, this deadline means an internal audit and sweeping technical changes, not just payment of a fine.

Indonesian Context

For users in Indonesia, this case is relevant because the majority of Android phones in the country rely on Google services. The Web & App Activity setting is on by default on many devices, so consumers risk having their location recorded without realizing it. Indonesia itself has a Personal Data Protection Law (UU PDP) that came into full force in October 2024, with administrative sanctions of up to 2% of annual revenue. Authorities in Jakarta can refer to the DPC precedent to strengthen oversight of global platforms, especially since location data is often used for political and commercial ad targeting.

The DPC is also investigating Google over the processing of EU citizens' data for AI models, as well as a probe since 2019 related to Ad Exchange. This series of cases makes Google a regular fixture of European privacy oversight. If Indonesian regulators adopt a similar approach, technology companies may have to adjust the architecture of their privacy settings in the Southeast Asian market—or face layered sanctions across multiple jurisdictions.

The question now is: how quickly will Google actually change how its location settings work, and will regulators outside Europe—including Indonesia—demand the same standard of transparency before consumers once again become data objects without control?