On Tuesday, European data protection agencies said Google's new privacy policy is not in compliance with EU laws.
The US search giant has been ordered to fix the problem immediately or face legal action.
"Google has a few months, three or four months, to comply. If it takes no action, we will enter a phase of litigation," the head of France's CNIL data agency, which took a lead role in a European probe into the company, told the AFP.
Google responded: "Our new privacy policy shows our continued commitment to protecting our users' data and creating quality products. We are confident that our privacy policies respect European law."
Google unveiled its new privacy policy in March, allowing the company to track users across various services such as YouTube, Gmail and Android mobile phones, to research demographics and develop aptly-targeted advertising.
“The CNIL led an investigation into the policy by data agencies from all 27 European Union member states and on Tuesday presented its conclusions at a press conference in Paris.” reported the AFP.
In a letter to Google, the agencies wrote that the US firm "provides insufficient information to its users, especially on the purposes and the categories of data being processed…As a result, a Google user is unable to determine which categories of data are processed in the service he uses, and for which purpose these data are processed," it said.
Isabelle Falque-Pierrotin, president of CNIL, told reporters that "we now demand adjustments" to the policy, failing which "authorities in several countries can take action against Google".
The following changes have been proposed:
Google must "reinforce users' consent". It suggests this could be done by allowing its members to choose under what circumstances data about them was combined by asking them to click on dedicated buttons.
- The firm should offer a centralized opt-out tool and allow users to decide which of Google's services provided data about them.
- Google should adapt its own tools so that it could limit data use to authorized purposes. For example, it should be able to use a person's collated data to improve security efforts, but not to target advertising.