The report comes as regulators in the U.S. and Europe prepare for possible antitrust cases against the company, as The Washington Post reported.
“Google empowers itself to collect vast amounts of personal data about internet users, but Google has not demonstrated that this collection was proportionate to the purposes for which they are processed,” the letter said.
Regulators also suggested that Google should provide simple opt-out mechanisms for users to control data collection, provide service-specific privacy policies in addition to its overarching rules and be sure to get explicit consumer consent for the combination of certain data.
The investigation was led by the French data protection agency, CNIL.
Google’s global privacy counsel, Peter Fleischer confirmed that the company has received the report and is reviewing it. In a statement, Fleischer said that Google stands behind its policy.