France's Commission Nationale de l'Informatique, which works on behalf of the EU's 27 national data regulators, said yesterday it had found legal flaws with a new approach to user data that Google adopted in March.
The firm's approach sees the pooling of information collected on individual users across its services, including YouTube, Gmail and the Google+ social network without giving users the choice to opt out.
The US tech giant then combines anonymous data from users' browsing histories to better target advertising. CNIL accused the approach of providing "incomplete and approximate" details raising "deep concerns about data protection and the respect of the European law".
CNIL president Isabelle Falque-Pierrotin said regulators are prepared to give Google time to make changes but warned it would take action if they failed to conform - presumably in the form of fines and litigation.
"If Google does not conform in the allotted time, we will enter into the disciplinary phase," she said.
Google has been told it should give clearer information about what data is being collected and for what purpose. It has also been told to give users more control over how the information is combined.
UK-based privacy campaign group Big Brother Watch welcomed the news.
"It's absolutely right that European regulators focus on ensuring people know what data is being collected and how it is being used," said the organisation's director, Nick Pickles.
"This ruling is an important step to putting consumers in control of their personal information and ensuring that companies like Google are not able to easily disregard people's privacy in pursuit of more information and greater profits", he added.
Google has given away little since the announcement.
"We have received the report and are reviewing it now," said Peter Fleischer, its global privacy counsel.
Image Credit: Flickr (kalexanderson)