Europe Presses Google to Change Privacy Policy

In a letter to Google, the regulators stopped short of describing the company’s 10-month-old data collection policy as illegal. But it noted that Google did not appear to adhere to Europe’s approach to data collection, which requires explicit prior consent by individuals and that the data collected be kept at a minimum.

The regulators couched their requests as “practical recommendations.” But when asked what regulators would do if Google did not accede and make changes, Jacob Kohnstamm, head of the Dutch data protection authority, said national regulators probably would take legal action to compel changes.

“After all, enforcement is the name of the game,” Mr. Kohnstamm said.

The request was made at a news conference in Paris by the French regulator, known as CNIL, or the National Commission for Computing and Civil Liberties, which was enacted on behalf of all European data regulators.

Google announced the new policy in January, billing it as a way to streamline and simplify the privacy practices it employed worldwide across about 60 different online services, and to introduce greater clarity for users

Google informed customers of its services, which include Gmail, Google Maps and YouTube, of the changes until they took effect in March, requiring them to agree to them in order to access their accounts.

European regulators voiced their concerns almost immediately and CNIL conducted an inquiry that lasted semonths.

Isabelle Falque-Pierrotin, the chairwoman of CNIL, said her agency was giving Google “three to four months” to respond to its concerns.

“If Google does not implement these recommendations, we will pass to a different phase, a phase of sanctions,” Ms. Falque-Pierrotin said.

Enforcement of privacy law in Europe remains a matter for national regulators. In France, CNIL has the legal ability to fine companies as much as €300,000, or about $390,000, for privacy breaches. But it remains unclear whether CNIL will levy a fine and whether other E.U. countries follow suit.

Google said in a statement that it believed that what it calls its privacy policy was legal.

“We have received the report and are reviewing it now,” Peter Fleischer, the Google global privacy counsel, said in the statement. “Our new privacy policy demonstrates our longstanding commitment to protecting our users’ information and creating great products. We are confident that our privacy notices respect European law.”

If adopted, the recommendations could have consequences on some of Google’s main businesses, which depend on consumer profiling for the targeting of advertising.

Jeff Gould, the president of SafeGov, a group based in San Francisco representing companies that sell software and hardware to governments, said Google’s privacy policy is very similar to that used by Microsoft and Facebook.

“Their approach is that we can take anything we learn from you from our services to build a profile of a user to serve targeted ads,” Mr. Gould said in an interview. “My view is that is a completely legitimate model if you give the consumer the opportunity to opt out.”

Google’s current privacy policy requires users to accept it before being able to use the full range of services, Mr. Gould said.

“The Europeans want Google to ask the user to give their consent explicitly and on a much more specific level, to permit the collection of data for targeted ads.”

“If Google did that responsibly, I don’t think it would kill their business,” Mr. Gould said. “But that is the 64,000 Terabyte question.”

In the letter sent to Google, the European data regulators said Google’s new policy allowed the company to “combine almost any data from any services for any purpose.”

“Google did not set any limits to the combination of data nor provide clear and comprehensive tools allowing its users to control it,” the letter said.

The regulators also noted that Google failed to tell the French investigators how long it kept certain kinds of data, despite being asked to.

The group asked Google to make several specific changes to give consumers more awareness and control over their data, including an interactive online presentation of how the data is used.