Italy's data protection regulator has ordered Google to change its attitude and policies towards data protection, including how it stores user data.
The advisory is part of an investigation into the search engine's practices by a number of European nations who say the consolidation of 60 of its privacy policies into one is not fair.
Most of Google's services were rolled into the policy in 2012, including YouTube, Gmail and Google Search, and the company did not give users the choice as to whether they wanted to accept the conditions or not.
The Italian regulator has said it wants Google to allow users to opt in to the conditions and advise them their data may be used for commercial purposes. It also wants Google to delete data relating to its users within two months.
The regulator has given the search giant 18 months to make the changes, saying the way the company currently deals with data is inadequate, even though Google has already made changes to its policy in order to meet local laws.
A Google spokesman said: "We've engaged fully with the Italian DPA throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services, and we'll continue to do so. We'll be reading their report closely to determine next steps."
Google will provide a document by the end of September, detailing what it plans to do and how it will meet Italy's demands. If Google does not comply, the company could face fines of up to 1m.
Other countries that complained about Google's use of data include the UK, Netherlands, France and Spain.
Last week, Google was involved in another line of questioning with the EU about how it deals with requests to remove links to outdated or irrelevant content in its search engine.
