Google Fined €403 Million Following Consumer Council Report

21. september, 2026

Google has been fined €403 million by the Irish Data Protection Commission after the Norwegian Consumer Council exposed how the company manipulated users into accepting extensive tracking.

In 2018, the Norwegian Consumer Council revealed how mobile users of Google’s Android operating system were manipulated into continuous tracking through deceptive design, misleading information, and repeated nudging.

Based on these findings, the Norwegian Consumer Council and seven European consumer organisations together with BEUC, filed complaints against the company for violations of data protection legislation. Eight years later, the Irish Data Protection Commission has reached its conclusion.

«Today marks an important milestone in the effort to protect our rights online. People must be able to understand what they are agreeing to without being deceived or manipulated into making choices they otherwise would never have made,» says Finn Myrstad, Director of Digital Policy at the Norwegian Consumer Council.»

«Knowing where we are means knowing a great deal about who we are. Location data can paint an extraordinarily detailed picture of our lives. This decision sends a powerful signal that companies cannot collect and use such information however they please.”

Following the complaint, Google made several changes to how it obtains consent and tracks users.

The case was handled by the Irish Data Protection Commission as Google has its European headquarters in Ireland. The decision may be appealed through the Irish courts.

Excessive Delays

The complaint against Google was submitted on 27 November 2018. At the same time, thousands of complaints remain pending before the Irish authority, including several filed by the Norwegian Consumer Council and other European consumer organisations.

«The time it has taken to process this case is beyond criticism. If we are to safeguard consumers’ rights and ensure fair competition online, it is essential that existing rules are enforced swiftly and in a way that effectively deters future violations,» says Finn Myrstad.

«Unfortunately, the Irish Data Protection Commission has become a bottleneck for the effective enforcement of data protection rules in Europe. Almost all major technology companies are established there, meaning that complaints filed on behalf of European consumers end up in a slow-moving system in Dublin.»

The seven national consumer organisations that filed complaints with their respective national data protection authorities were Forbrukerrådet (Norway), Consumentenbond (The Netherlands), Ekpizo (Greece), dTest (Czech Republic), Zveza Potrošnikov Slovenije (Slovenia), Federacja Konsumentów (Poland) and Sveriges Konsumenter (Sweden). In addition, Forbrugerrådet Tænk (Denmark) reported these practices to the Danish data protection body.

Please also see BEUCs page for further overview of the case.