Last year the company united the privacy policies for all products, allowing unified data collection across platforms such as Gmail, YouTube, Google+ and Maps.
The changes were implemented despite a warning from France's data privacy commission that the new policy may be unlawful.
The ICO says it is particularly concerned that the updated policy does not provide enough information for UK users to understand how their data is being used across the company's different products.
The Commissioner has given Google until 20 September to take "necessary action to improve the policies compliance", after which there will be the possibility of legal enforcement.
The action has been taken following a consultation with 27 data protection authorities from across Europe.
Concurrently, Hamburg's influential Commissioner for Data Protection, Professor Johannes Caspar said the policy "violates the company's commitment to full transparency about the use and handling of the data."
He also announced plans to call Google into a legal hearing to comment on the allegations.
The French and Spanish equivalents sent similar letters last month, with France's CNIL threatening fines if Google did not comply.
When the new policy was announced at the beginning of 2012, Google said change was needed to help with product integration and so the company could "create a beautifully simple, intuitive user experience."
The action comes as American NSA whistleblower Edward Snowden recently revealed the extent to which the US Government has been collecting data from Internet giants such as Google, Microsoft and Apple.
This week the European commission warned that European businesses may abandon US Internet and cloud service providers over the scandal.