Google has pushed its customers' privacy rights "too far" said experts after the search giant was ordered to revise its policy by the EU.
European watchdogs, led by the French regulator CNIL, said in a landmark report that Google had to give clearer information about what data it was collecting, and how it was used.
The inquiry followed Google's decision to consolidate 60 different documents into one privacy agreement in March.
The move allowed the company to use data collected in different products to inform changes in all of its services.
But the regular said that users had not been adequately informed about the change, and had not placed any limit on "the scope of collection and the potential uses of the personal data".
It said Google's current document did not distinguish between search terms and - for instance - phone numbers.
It said:
"Google's answers have not demonstrated that your company endorses the key data protection principles of purpose limitation, data quality, data minimization, proportionality and right to object. Indeed, the Privacy policy suggests the absence of any limit concerning the scope of the collection and the potential uses of the personal data. We challenge you to commit publicly to these principles."
Among its recommendations were for Google to provide an easy way for consumers to opt-out of data tracking, limit the use of its wider data pool to security operations, and "reinforce users' consent" with specific buttons for each type of information.
Google said in response that it would "review" the findings.
O"ur new privacy policy demonstrates our long-standing commitment to protecting our users' information and creating great products. We are confident that our privacy notices respect European law," Peter Fleischer, the company's global privacy counsel, told the BBC.
But privacy expert Justin Basini, CEO of ALLOW said that the company had to do more - and did not have an "automatic right" to its customers data.
Basini said: "Google has gone too far by pooling data across all it's products. It has been able to build incredibly rich profiles on individuals for advertising purposes without people really knowing what is going on. Google offers fantastic products for free and people like using them, but there has to be more transparency about what data is collected and what it is used for.
"What companies like Google have to remember is that they don't have an automatic right to harvest information about what we're interested in and what we are likely to buy. The pooling of data has been particularly invasive because the file that the company has on you is that much fatter."
"We're particularly concerned about how Google intends to unbundle this rich data that they have gathered. It's really a treasure trove from an advertisers point of view and now they have to find a way of unpicking it all.
"Google doesn't exactly have a good track record when it comes to sorting out privacy problems, such as the furore over deleting StreetView data collected from household WiFi networks. CNIL is asking Google to dismantle its biggest asset."
Jim Killock, Executive Director of the Open Rights Group, said:
"It's good to see European data protection authorities take action so that users gain control of their data.
"This must be backed by strong new data protection powers, for fines based on turnover, and rights to retrieve and to delete your data."