Ireland's Data Protection Commission fined Google €403 million for unlawfully processing location data. According to Proton, Alphabet can cover this fine with about 55 hours of cash flow, making the deterrence of the sanction debatable.
Ireland's Data Protection Commission (DPC) has fined Google €403 million (about $462 million) for unlawfully processing users' location data. However, according to privacy firm Proton, this fine is not large enough to change the tech giant's behavior.
According to Proton's calculation, Google's parent company Alphabet could cover this fine with just its cash flow in about two days. The company stated that this period corresponds to approximately 55 hours, or 199,000 seconds of standard revenue generation.
'A Small Cost' for the Company
In her assessment of the matter, Proton's Head of Public Policy, Jurgita Miseviciute, stated that the fine lacks deterrence. Miseviciute said, "If one of the European Union's biggest weapons costs the violator only two days' revenue, that is not deterrence."
The sanction announced by the DPC came after a long-running investigation into Google's location data practices between 2018 and 2020. The fine was recorded as one of the largest GDPR sanctions the search giant has faced to date.
However, given Alphabet's size, the impact is said to remain mathematically very small. The company's reported free cash flow of $73.3 billion for 2025 corresponds to about $200 million per day. According to Proton, in this picture, the fine can be covered by two days and seven hours of cash flow.
Deterrent Effect of Fines Questioned
The €403 million fine alone does not set a precedent. In 2025, Google received five separate fines totaling approximately $4.24 billion. According to Proton, the company's free cash flow could cover this total in about three weeks.
A similar trend was seen the previous year. It was assessed that the industry could pay fines exceeding $8 billion in 2024 in less than three weeks. Proton warned that big tech companies could cover collective fines exceeding $7 billion in 2025 in just one month.
Miseviciute argued that fines, even if they make headlines, do not change company behavior. She said that if regulators are serious about compliance, sanctions need to be truly felt.
For consumers, this means that the responsibility for data security largely remains in their own hands. Location data is considered a sensitive data category because it can reveal a lot of information, from a person's home address to their daily routine and hospital visits.
