Google should better inform users on how their data will be used and set more precise limits on how long data will be retained, among other recommendations. But in good news for Google, the commission stopped short of calling for wholesale revisions to the policy, or demanding that Google create new ways for users to opt out of data collection and retention.
Google's global privacy counsel told Reuters the company would examine the recommendations but was confident Google is not violating EU law.
If found to be violating users' privacy, Google could face fines. It was previously fined when its Street View cars, which provide data for Google Maps, were discovered to have collected unauthorized data using public Wi-Fi networks.
In March, Google changed privacy practices across its network of services, consolidating 60 separate policies into one. The new policy allows data to be collected on users across a wide range of Google services for advertising targeting purposes.