Google's privacy policy violates Dutch data protection law, Dutch DPA says
Google's practice of combining personal data from different Google services violates the Dutch data protection act, the Dutch data protection authority (DPA) said Thursday. But Google will not face any enforcement actions for now.
Context & Ripple Effects
The Dutch finding is the latest turn in a scrutiny cycle that has run for years: EU data-privacy officials first opened a probe into Google's privacy practices in 2007 over its handling of user search data, and in 2011 attention shifted to Google Analytics being targeted by data protection officials. Today's statement narrows the complaint to a specific practice — combining personal data gathered across Google's separate services under its unified privacy policy.
First-order effects
- Google now carries a formal legal finding that its cross-service data combining violates the Dutch data protection act, though the DPA has explicitly declined enforcement action for now.
- Dutch users see no immediate change: the data-sharing practices flagged by the DPA remain in place while Google negotiates rather than complies under penalty.
Second-order effects
- Other national data protection authorities in the EU gain a template — a named violation with no sanction attached — that lowers the cost of issuing their own findings against the same policy.
- Google faces pressure to justify one global privacy policy against jurisdiction-by-jurisdiction rulings, raising the compliance burden on a policy designed for uniformity.
Third-order effects
- If regulators keep issuing findings without enforcement, the pattern points toward negotiated compliance regimes where large platforms adjust practices bilaterally with each DPA rather than facing fines — and toward eventual fragmentation of what a single privacy policy can legally cover across the EU.
The trend: European data protection authorities, probing Google since at least 2007, are shifting from open-ended investigations to specific legal findings about how it combines user data across services.