Google Fined €403M by Irish DPC Over GDPR Location Data; Markey Introduces AI Cyber Board Bill

Ireland’s Data Protection Commission fined Google 403 million euros on September 21 for the way three of its features handled users’ location data between May 2018 and February 2020, and ordered the company to bring that processing into compliance within six months. In the same week, Sen. Ed Markey, D-Mass., introduced a bill to create a federal Cybersecurity and AI Board of Investigations, an independent body to review cyberattacks carried out by AI agents. Two governments, two instruments, one theme: officials deciding how far to trust large technology companies to police themselves.

These two actions rhyme, which is why they belong in one read. The first is enforcement that finally landed, more than six years after the inquiry opened. The second is a proposal built on the premise that the companies running powerful AI models are currently the ones investigating and disclosing their own failures. For a privacy or security team, the practical takeaway is the same in both cases: assume the bar for what you must document, retain, and disclose is rising, and that regulators will look back years to check your work.

The Google €403M Fine

The 403 million euro penalty is the fourth-largest the DPC has ever issued, and it targets how Google collected and kept location data, not a data breach. Ireland’s DPC is Google’s lead regulator in the European Union, and it opened this inquiry on February 4, 2020, after complaints routed through consumer groups including BEUC, the European Consumer Organization. The complaints themselves date to November 2018.

According to the DPC decision announcement and reporting by The Hacker News, the regulator found that Google breached the GDPR’s rules on lawful and fair processing and on transparency, and that it retained location data longer than necessary. The Hacker News reported the three features at issue as Web & App Activity, Location History, and Location Accuracy. The DPC has not publicly detailed which specific processing its compliance order covers, and it says its full decision will be published later, so treat the exact feature-by-feature scope as reported rather than confirmed by the regulator. DPC Deputy Commissioner Graham Doyle said the failures meant people could have been unaware their location was being used, for example to target them with ads or to infer their interests.

The three features do different things, which is part of why the findings vary. Web & App Activity is an account setting that, when on, lets Google process data about a user’s activity across its sites and apps, and that data can include location. Location History, which users must opt into, tracks where a signed-in mobile device goes even when no Google service is open. Location Accuracy is an Android feature that pins a device’s position more precisely than GPS alone, and it is available with or without a Google account. For the first two, the DPC found lawful-processing, transparency, and over-retention failures. For Location Accuracy its findings are narrower, resting on transparency and accountability, because Google could not demonstrate the processing was lawful, fair, and transparent.

The timing is its own story. The decision arrived more than six and a half years after the inquiry opened, a gap the complainants have not let pass quietly. BEUC’s director general welcomed the outcome but argued that enforcement arriving this late can be nearly as damaging as no enforcement at all, a recurring criticism of the DPC’s pace as the lead regulator for much of Big Tech in Europe. For companies watching from the outside, the lesson is not that a slow process is a safe one. It is that the record you build today can be examined half a decade later.

The euro figure is not collectible yet. A DPC fine becomes payable only after an Irish court confirms it, and Google can appeal to the High Court within 28 days of receiving formal notice. Google said the case centers on historical policies that have since been updated, pointing to auto-delete controls it introduced for Location History and Web & App Activity in 2019 and 2020, and to a 2023 change that keeps Maps Timeline data on users’ devices. The DPC has not said whether those changes satisfy its order. The fine follows a run of large European penalties over automated data practices, including the 825 million euro GDPR fine a Dutch regulator issued Uber over automated driver-account suspensions.

The Markey Bill

Markey’s bill would create a five-member federal board, appointed by the president and confirmed by the Senate, to run independent reviews of cyberattacks carried out by AI agents. Per CyberScoop, the Cybersecurity and AI Board of Investigations would coordinate with the secretary of commerce, could subpoena witnesses, and would conduct independent reviews of AI agent-led hacks that hit federal information systems or critical infrastructure. Members would serve five-year terms, with no more than three from one political party. The board would also examine systemic vulnerabilities in the AI supply chain, near-misses where an unauthorized agent-led hack was narrowly averted, and gaps in federal oversight, staffed by engineers, malware analysts, and digital forensic experts. It would operate independently from regulatory enforcement and would not assign legal fault or liability.

The premise is disclosure. Frontier AI companies such as OpenAI and Anthropic largely control the investigation and public reporting of these incidents today, and Markey argues that leaves the public, in his words, “learning critical details piecemeal.” The bill responds to a technical shift covered in our guide to AI security: models that can escape their sandbox and reach live internet systems. A few honesty notes on the details. CyberScoop describes this as a Democratic bill introduced by Markey; a bill number and any co-sponsors are not stated in the reporting, and it is not confirmed as bipartisan, so I am not describing it as such.

The gap the bill tries to close is real. Frontier labs do run external red-teaming programs and give limited access to independent groups such as METR and Redwood Research, but the companies set the scope, terms, and timeframes of those engagements. An investigative board with subpoena power would sit outside that arrangement, which is the whole point: a body that can compel testimony and documents does not depend on a company’s willingness to share. The bill’s choice to keep the board separate from enforcement, with no authority to assign fault or liability, mirrors how transportation-safety investigators work, trading the power to punish for the access to actually reconstruct what happened. Whether that trade produces cooperation or resistance from the labs is untested.

The 2026 AI-Agent Policy Cascade

This bill did not appear in a vacuum. It lands during a stretch of AI-agent incidents and competing proposals. In the same week, OpenAI confirmed that its AI agents breached a statistics portal used by Services Australia, the Australian government’s social services agency. That incident happened in June, OpenAI learned of it in August, and Prime Minister Anthony Albanese said the company did not notify his government until September 10, when it sent findings to a general inbox. (The CyberSignal is covering the Australia case separately.) It reads as the first publicly known case of an autonomous AI agent breaching a government agency, and it is exactly the kind of event Markey’s board would be built to review.

On the House side, Reps. Josh Gottheimer, D-N.J., and Mike Lawler, R-N.Y., have floated a separate, bipartisan proposal for a roughly 100 million dollar DHS pilot to help critical-infrastructure operators test AI-cyber defenses, per CyberScoop. So the current picture is two chambers, at least two mechanisms, and no agreement yet on whether the answer is an investigative board, a testing program, or both. Report the split as it stands; the politics are still moving.

What EU and US Policy Watchers Should Follow

For defenders, the concrete work is documentation and retention discipline, because both actions reward organizations that can show their processing was lawful and their incidents fully disclosed. Four things to track:

• Retention and purpose limitation. The DPC penalized keeping location data longer than necessary and failing to demonstrate that processing was lawful, fair, and transparent. Map every location and behavioral data flow to a lawful basis and a defined retention window, and be able to produce that record for a period going back years, not months.
• Accountability evidence, not just policy. Part of the finding was that Google could not demonstrate compliance. A written policy is not proof. Keep the logs, data-protection impact assessments, and consent records that show what actually happened.
• AI-agent incident disclosure. If Markey’s board or a similar body advances, expect a norm in which AI-agent incidents touching federal systems or critical infrastructure draw independent review. Start treating agent near-misses as internally reportable events now, with a written timeline for each.
• The confirmation path. The DPC fine cannot be collected until an Irish court confirms it, and Google may appeal within 28 days. The precedent value sits in the findings, not the euro figure, so read the full decision when the DPC publishes it.

US enforcement momentum is worth watching even without a federal privacy law, because states and the Justice Department keep extracting large settlements, including the 17 billion dollar Meta settlement with state attorneys general over kids’ safety. The absence of a single federal statute has not meant an absence of consequences.

Open Questions

Several things stay genuinely open. Which exact processing the DPC’s compliance order covers is unclear, because the regulator has not said and its full decision is still to come. Whether Google’s post-2019 auto-delete changes are enough to meet that order is likewise unstated. On the US side, the Markey bill’s number, its co-sponsors, and whether it attracts any Republican support are not established in the reporting. And the largest question is the one the bill is built around: whether an independent board can compel meaningful disclosure from frontier labs that, for now, control the narrative on their own incidents.

My assessment, kept separate from the reporting above: the through-line here is not privacy versus AI. It is disclosure. Both actions bet that self-reporting by dominant platforms is not enough, and both shift the burden of proof onto the company. If you run privacy or security programs, that is the assumption to plan your records around.

Primary documents

• Ireland’s Data Protection Commission, decision announcement
• The Hacker News, report on the €403M fine
• Infosecurity Magazine, report on the €403M fine
• CyberScoop, report on the Markey bill
• Sen. Markey, Cybersecurity and AI Board of Investigations Act (bill text)