In a move that France hopes will be followed by other European states, the national data protection agency Cnil said the US Internet giant had failed to provide it with sufficient assurances about the storing and use of data it obtains from users.
"The information received in respect to this have so far been too imprecise or vague," Cnil President Isabelle Falque-Pierrotin said.
She said that Google must set a clear limit on the length of time it can store the data obtained from web surfers and seek prior approval from them before installing cookies on their devices.
The changes make it easier for Google to collect and process data that could be used by advertisers to target individuals with offers tailored to their specific interest, thereby increasing the company's revenue potential.
Also Read
The changes have been widely criticised because of the implications for privacy but the pressure on Google to change how it operates has been limited to date.
The 27-member European Union warned Google in October 2012 that its data protection procedures did not comply with an EU directive on the subject and gave the company four months to change them.
Cnil President Falque-Pierrotin noted that while the maximum fine Google could face under French law was relatively small, Spain has the capacity of impose a penalty of up to one million euros (USD 1.3m).
Google has defended the changes it made last year on the ground that they simplify and standardise its approach across its various services.
But critics argue that the policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the operator of the world's largest search engine unprecedented ability to monitor its users.