If Google doesn't change how it handles users' private data by the end of February, it may face fines of €15 million (about US$18.6 million), the Dutch Privacy Authority said Monday.
"Google catches us in an invisible web of our personal data without telling us and without asking us for our consent. This has been ongoing since 2012 and we hope our patience will no longer be tested," said Jacob Kohnstamm, chairman of the Dutch DPA.
By the end of February, Google should get "unambiguous consent" from its users before it combines personal data from different Google services to serve targeted ads, the DPA said. This could for instance be achieved by introducing a separate consent window.
Google recently sent a letter to the six DPAs, announcing a number of measures to comply with EU privacy laws. The Dutch DPA "has not yet established whether the proposed measures will end all the violations," it said.
Google was already fined €150,000 by French privacy authority CNIL in January. That fine followed a €900,000 fine from the Spanish data protection authority last December.
Loek is Amsterdam Correspondent and covers online privacy, intellectual property, online payment issues as well as EU technology policy and regulation for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to firstname.lastname@example.org