Officials in the Netherlands have told Google to revise its privacy policy by February, or face fines of as much as $18 million.
"Google catches us in an invisible web of our personal data without telling us and without asking us for our consent,” Jacob Kohnstamm, chairman of the Dutch Data Protection Authority, said in a statement issued on Monday. “This has been ongoing since 2012, and we hope our patience will no longer be tested.”
The move marks European authorities' most recent protest to Google's 2012 changes to its privacy policy. Since March of that year, Google has combined information about signed-in users across a variety of products and services, including Gmail, Android, and YouTube. The company uses that aggregated data to serve targeted ads to users across different platforms.
People can't opt out of the data combination. Instead, if they don't want Google to use data to create detailed profiles of them, they must access sites without signing in, or use different browsers for different purposes.
The Dutch Data Protection Authority said on Monday that Google doesn't adequately obtain users' consent to aggregate data collected across different platforms. Officials in the Netherlands say that Google must obtain users' “unambiguous consent” before combining information about them collected from various services.
A Google spokesperson said the company is “disappointed with the Dutch data protection authority’s order,” adding that it has “made a number of changes to our privacy policy in response to their concerns.”
The spokesperson added: “We’ve recently shared some proposals for further changes with the European privacy regulators group and we look forward to discussing with them soon.”
The Dutch officials acknowledge that Google recently spelled out potential new changes to its privacy policy, but say they're still evaluating “whether the proposed measures will end all the violations found by the Dutch DPA.”
In the U.S., lawmakers and regulators questioned Google about its 2012 privacy policy changes, but didn't try to prevent the company from moving forward. Consumers filed a class-action lawsuit against the company, but a federal judge dismissed all of the allegations relating to the change in privacy policy. (A claim relating to Google Wallet's privacy policies is still pending.)
By contrast, European regulators have tried to convince Google to revamp its policies. In August, regulators in Germany told Google to obtain users' consent before combining data collected over various services. Last year, the French privacy agency CNIL criticized Google for failing to adequately respond to official complaints. Shortly afterward, officials in Britain, Germany, Italy, Spain and the Netherlands said they planned to investigate the company.
Privacy is just one of the challenges facing Google in Europe, where officials appear to be increasingly concerned about the company's market power. Last month, a report surfaced that EU regulators were poised to seek to break up the company. Since then, other reports have indicated that there could be a settlement. Last week, officials reportedly sought additional information from Google's competitors.
Spanish lawmakers also recently took aim at Google News with a new bill that requires Web companies that post headlines and excerpts to pay publishers. Google responded by saying it will shut down Google News in Spain this week.