The Irish Data Protection Commission's €403 million fine against Google for location-data processing failures between May 2018 and February 2020 highlights a crucial issue: transparency in data use. Users may not have known their location data was used for ads or to infer interests, risking their control over personal data. This transparency failure is a risk for any organization handling location data.
If your team collects location coordinates, WiFi signals, GPS data, or IP-derived geolocation for purposes not immediately clear to users, you're at risk. Here's how to audit your location-consent implementation before a regulator does.
Preparation for Audit
Access and Documentation
Ensure you have access to your Consent Management Platform (CMP) configuration, your mobile app's permission-request code, and any server-side logic processing location signals. Gather your current privacy notice and consent-flow screenshots. If you use a Tag Manager, export your container configuration.
Stakeholder Availability
Ensure you can contact your product team (for data feeds), ad-operations team (for partner data sharing), and CMP vendor manager. You'll need quick responses when you find gaps.
Baseline Inventory
List every context where you request location access: mobile permissions, browser geolocation API calls, background location collection, and inferred location from IP addresses. Include both first-party uses (store locator, delivery estimates) and third-party data flows (ad networks, analytics SDKs).
Step-by-Step Implementation
Step 1: Map Location Data to Disclosed Purposes
Review your privacy notice for location processing mentions. Compare this with your CMP's purpose taxonomy. For each data flow, note the disclosed purpose it serves.
If you're using location data for ad targeting but only mention "improving your experience" in your consent notice, you have a disclosure gap. Your notice must explicitly state Behavioural Advertising if that's the use.
Check your CMP's granularity settings. If users can accept "Analytics" as a single toggle but you're sending precise GPS coordinates to different analytics vendors, you're bundling purposes that GDPR Article 7(2) requires you to separate.
Step 2: Audit Consent Timing
Review when you request location access versus when you disclose its use. If your app requests location permission before explaining its advertising use, you're collecting data without valid consent.
For browser-based requests, ensure navigator.geolocation.getCurrentPosition() doesn't fire before your CMP resolves user choice. The sequence matters as much as the disclosure language.
Background location collection needs explicit disclosure. If your app tracks location when not in use, your consent notice must clearly state this, not hide it in a general clause.
Step 3: Verify Symmetry and Withdrawal
Test your consent interface. Can users reject location processing as easily as they accept it? If rejecting requires more effort, you're creating a barrier the EDPB Guidelines consider non-compliant.
Test withdrawal. If a user revokes consent, does your system stop processing coordinates for advertising immediately? Check both client-side (does the SDK stop collecting?) and server-side (do you purge queued signals?). Withdrawal must be as easy as granting consent, per GDPR Article 7(3).
Step 4: Review Third-Party Disclosures
Export your CMP's vendor list. Verify your consent notice names each third party receiving location data or provides a way to view the complete list. Generic statements like "our advertising partners" don't meet transparency requirements.
If using TCF v2.3 strings to pass consent downstream, audit whether your vendors respect the geolocation special-feature flag. Run a packet capture during a test session where you've denied consent. If you see lat/long coordinates in ad requests, your vendor integration is broken.
Step 5: Document Inferred Location
IP-to-city geolocation is often overlooked but still requires valid consent under the ePrivacy Regulation's terminal-equipment-access rules.
Check your server logs or CDN configuration. If you're extracting location from IP headers before users interact with your consent notice, you're processing data without prior consent. Move that logic behind your CMP's consent check.
Validation: How to Verify It Works
User-Journey Testing
Create test accounts and walk through every entry point where location is requested. Record the sequence: What does the user see first? What happens if they deny consent? What happens if they accept, then withdraw later?
Use browser developer tools to monitor network requests. After denying consent, you should see no outbound requests with coordinates, geolocation API calls, or IP-derived location parameters. Trace any you find back to the responsible script or SDK.
CMP Configuration Review
Log into your CMP's admin panel and verify that location-related purposes aren't bundled with unrelated processing. Your "Behavioural Advertising" purpose should be independently toggleable.
Check your consent-renewal settings. For high-risk processing like Behavioural Advertising, consider periodic re-consent (every 12-18 months) rather than indefinite consent validity.
Third-Party Audit
Request a data-flow diagram from each vendor receiving location data. Ask: What do you do with coordinates when consent is denied? How quickly do you process withdrawal requests? Do you pass location to sub-processors?
If a vendor can't answer these questions specifically, they're a compliance risk. The DPC's Google investigation examined if users could lose control over their data. If you don't know what your vendors do with location signals, you can't assure users they maintain control.
Maintenance and Ongoing Tasks
Quarterly Consent-Flow Reviews
Every product release affecting location features should trigger a consent-flow review. If you add a new partner, launch background tracking, or infer interests from visit patterns, update your purpose disclosures before deployment.
Regulatory Monitoring
The Google investigation covered May 2018 to February 2020. Since then, the EDPB has published more guidance on consent, the ePrivacy Regulation remains in draft, and national DPAs have issued specific recommendations on location processing. Subscribe to updates from your lead supervisory authority and review new guidance within 30 days of publication.
Vendor Re-Assessment
Audit your third-party location-data processors annually. Request updated sub-processor lists, review changes to their data-retention policies, and verify they're respecting your consent signals correctly.
The €403 million fine wasn't about Google's size. It was about transparency failures any organization could commit. Your location-consent implementation either gives users genuine control over their data or signals non-compliance to the next investigator.
