The US internet giant Google was ordered on Thursday to bring its privacy settings in line with French law within three months or face sanctions.
France’s data-protection authority is leading a European challenge to Google’s new privacy policy, which allows the pooling of data on users from across Google services, such as YouTube and Gmail.
The policy, introduced in March 2012, allows Google to build a more complete profile of users.
Google said the move as aimed at improving services for users, but the shift appeared principally aimed at building up a comprehensive profile of users that could be used by advertisers.
In October, 27 data-protection authorities recommended changes to the policy to bring it in line with European legislation, but the company has stonewalled the request, insisting it is fully compliant with EU law. In April, six European data watchdogs announced they would take action against the company.
France’s National Commission of Information Technology and Liberty said its investigation confirmed Google was in breach of French law because it “prevents individuals from knowing how their personal data may be used and from controlling such use.” The commission gave Google three months to inform users of how their data was being used by the company and how long it would be stored.
Google was also ordered to “not proceed, without legal basis, with the potentially unlimited combination of users’ data” and to seek users’ prior consent before installing cookies, the files that track people’s internet searches, on their devices.
Failure by Google to comply would lead to sanctions, the commission warned.
The threat of sanctions was unlikely to cause alarm at Google. The maximum fine the commission may impose is 150,000 euros ($ 198,200).
The bill could be steeper, however, if other European countries follow suit.
Germany, Italy, the Netherlands, Spain and Britain were also investigating Google’s compliance with their laws, the commission said.