The news that Ireland’s Data Protection Commission (DPC) has fined Google €403 million (about $462 million) for illegally processing users’ location data may sound like a major victory for consumer privacy. However, industry experts are already warning that the fine is simply too small to bring about a change in the companies’ behavior.
See also: Ireland: Google fined €403 million for location data
The DPC’s decision follows a lengthy and detailed investigation that began in 2018 and concluded in 2020. The investigation focused on Google’s practices regarding the collection and processing of users’ location data, which were deemed questionable and in breach of the General Data Protection Regulation (GDPR). This penalty represents one of the largest ever imposed on the search giant under the GDPR.
The General Data Protection Regulation, which came into force in 2018, aims to strengthen the protection of EU citizens’ personal data and give users more control over their information. However, the effectiveness of the regulation has been questioned, as big tech companies appear to view fines as simply a cost of doing business.
According to privacy firm Proton, Google’s parent company, Alphabet, will be able to get through this historic penalty in less time than it takes to enjoy a long weekend. “Google will barely notice this fine,” noted Jurgita Miseviciute, head of public policy at Proton. “When one of the biggest weapons in the EU’s arsenal costs the offender just two days of revenue, it’s not a deterrent.”
See also: Proton Data Breach Observatory: Notifies you when your personal data appears on the Dark Web
Alphabet, Google's parent company, reported free cash flow of $73.3 billion for 2025, which breaks down to about $200 million per day. That means Google's cash flow alone could cover the fine in about two days and seven hours. To put that into perspective, that's about 55 hours, or 199,000 seconds, of typical revenue generation.
This mirrors an equally disappointing pattern from the previous year, when the industry took less than three weeks to pay off more than $8 billion in penalties. This recurring pattern has left privacy advocates frustrated by the limitations of the current European Union regulatory framework. Proton’s Miseviciute stressed that the lack of financial pain makes these penalties merely a cost of doing business rather than a real deterrent.
Fines, like the GDPR fine imposed on Google, are intended to encourage companies to comply with regulations and protect user data. However, the effectiveness of these fines depends on whether they are large enough to cause financial pain and force companies to change their practices. In Google’s case, it appears that the fine is not significant enough to bring about such changes.
See also: Britain: Stricter rules for Google's screen suggestions due to AI
The debate over the effectiveness of GDPR fines continues, with many arguing that stricter measures and higher fines are needed to ensure compliance by big tech companies. Protecting privacy is an issue that continues to concern both consumers and regulators, and the need for effective enforcement is more urgent than ever.
