But European Union officials stop short of calling for massive changes to the new policy.
Google should better inform users on how their data will be used and set more precise limits on how long data will be retained, among other recommendations. But in good news for Google, the commission stopped short of calling for wholesale revisions to the policy, or demanding that Google create new ways for users to opt out of data collection and retention.
Google's global privacy counsel told Reuters the company would examine the recommendations but was confident Google is not violating EU law.
If found to be violating users' privacy, Google could face fines. It was previously fined when its Street View cars, which provide data for Google Maps, using public Wi-Fi networks.
In March, Google changed privacy practices across its network of services,. The new policy allows data to be collected on users across a wide range of Google services for advertising targeting purposes.