An Italian data-regulation official told Google it has 18 months to change how it stores users' information.
Italy is one of several European countries that have been jointly investigating Google's consolidation of 60 different privacy policies into one last year, Reuters reports. The Italian watchdog said in a statement that Google's disclosures about data use were insufficient, despite the company's efforts efforts to abide by local laws.
A spokesperson for Google said the tech company has consistently cooperated with the inquiry and will continue to do so after it reviews the watchdog's latest decision.
Google has a year and a half to, among other demands, start asking for users' consent to profile them based off their data for commercial purposes. The official also asked Google to follow through on users' requests to delete their personal data within two months.
In addition to the 18-month deadline, Google must also present in September a detailed plan for how it intends to meet the regulator's demands. If Google ultimately does not comply with the regulator, it could face fines.
France and Spain have already fined the company for violating local data-protection laws. A Dutch regulator is still deciding whether to take steps to enforce changes following similar legal breaches in the Netherlands.