Google has 18 months to comply with European privacy regulations

Google has been given 18 months by the Italian data regulator to change how it handles and stores user data. Users will now have to grant permission before the firm creates a profile on them, and Google has to honour requests to delete data within two months (although it will have an additional six months to remove the content from backups). Google will also have to explicitly inform users that the profiles it creates on them are for commercial purposes. In a statement, the data watchdog said Google’s disclosure to users remained inadequate, despite it having taken steps to follow local law. A Google spokesman said “We’ve engaged fully with the Italian DPA throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services, and we’ll continue to do so. We’ll be reading their report closely to determine next steps.” It has also agreed to present a roadmap to the regulator by the end of September, showing how it will comply with the decision. The command follows a cross-European investigation that found that the Californian company was in violation of the EU’s privacy policy laws. Italy’s Data Protection Authority led the inquiry, which began after Google consolidated 60 of its privacy policies into one all-encompassing policy, covering services as varied as YouTube, Gmail and Google Search. Users were not given the ability to opt out of the consolidation.