Ireland’s six-year location inquiry just cost Google $463 million, and the copy of you on the street is still growing.

If you run cybersecurity for a company that issues phones, badges, or fleet vehicles, that fine is your preview. Ireland’s Data Protection Commission closed an inquiry that began in early 2020 and billed Google more than €403 million for how it processed location data. You will not get a six-year runway. Your users already mint the same class of record when a handset wakes, a badge hits a reader, or a city camera clocks a bumper.

Hackers who captured a Flock automatic license plate reader found software that classified people, vehicles, plates, and bicycles. Recovered logs held more than a million images across a few weeks. The camera could fire dozens of frames at one passing car. Vision code isolated bumper stickers and, in one case, an American flag patch on a motorcyclist’s saddlebag. The most sensitive storage stayed encrypted. The classifier kept working.

That pipeline is now part of your threat surface, whether you bought it or not.

Washington is shopping an AI incident alert system in talks with China in the same news cycle. Treasury Secretary Scott Bessent put the idea in public while U.S. policy keeps model development on the accelerator, arguing a slowdown would help Chinese firms catch up. A diplomatic hotline will not inventory your geodata. It will not mute a pole camera that already tagged a staff motorcycle.

Location Left Your Asset Inventory

Most teams still file coordinates under privacy and walk them over to counsel. Location is a production dataset with a long half-life. It joins identities. It rebuilds routes. It tells an attacker which executive is in the office and which badge never left the garage.

Google’s finding was about processing at planetary scale with controls Irish regulators rejected. Your version lives in mobility apps, expense geotags, camera exports, badge logs, and the little map inside a ticketing tool. None of that sits next to the brute-force alerts your SOC already trusts.

A camera that can lift a sticker can lift a vendor magnet on a company van.

Physical reconnaissance now ships with a computer-vision budget. You do not get a purchase order for that risk. You get a PDF from a city vendor, or nothing.

Cybersecurity Still Stops at the Perimeter

Your firewall never saw the Flock box. Threat-protection catalogs still chase malware families while geodata walks out through SaaS exports and camera outfits you never contracted. Defense in depth that dies at the NIC is a slide.

Street-level collection does not file a change ticket with your SOC.

Treat every store that holds coordinates, geotagged photos, plate-like identifiers, or badge-to-desk joins as a credential spill waiting on a subpoena. Do the ugly inventory this week, then keep it honest.

Name the owner of MDM location, expense geotags, fleet GPS, parking, visitors, building cameras, and find-my-device. If a store has no owner and no deletion job, freeze new collection and cut the export API the same day.

Lock bulk export, OAuth grants, and BI joins that stitch HR to badge swipes. Rotate standing tokens. Least privilege on geo APIs is security hardening you can ship before Friday.

Point threat detection at unusual dumps: after-hours badge history queries, new OAuth on a maps processor, a vendor admin portal eating password guesses. Those portals are identity hosts with maps attached. Brute-force noise there is a location incident.

Write incident response that starts with token kill and copy destruction when a phone maker, ALPR vendor, or maps processor notifies you. Assume route reconstruction. Skip the press release.

Run that loop quarterly. Vendors add fields. Cities add poles. Your CMDB will notice neither.

Treat Geo Copies as Spill Data

The Google bill is a lagging indicator. The inquiry started in 2020. Cyber security teams that wait for a regulator to rank this will spend the next finding explaining why fleet GPS, visitor kiosks, and optional location on the corporate portal all pointed at the same people.

If you cannot delete it this quarter, stop collecting it this week.

Pull a sample: last 30 days of badge-to-desk, fleet breadcrumbs, and any camera export that left the building. If you cannot say who queried it, you already have the Google problem at human scale.

Governments want faster notice when models go sideways. Your notice problem is closer. Someone will ask for the badge log, the parking export, and the phone history on the same afternoon. Incident response that cannot produce a location-data map in an hour will invent one under pressure. That is how you inherit a six-year finding without Google’s cash.

Keep the legal memo.

Build the kill switch anyway.

Sources

• EU data regulator fines Google more than $460 million for location data violations
• Google Hit With $463 Million Fine for EU Location Data Rule Breach
• Reverse-Engineering Flock Cameras
• US Proposes AI Incident Alert System in Talks With China, Bessent Says