Google said in January it was simplifying its privacy regulations, consolidating 60 guidelines into a single policy that will function across all its services, including YouTube, Gmail and Google+, its social networking site.
Regulators are concerned that Google may share personal data across all of its platforms without giving users the chance to give their prior consent.
The Article 29 Working Party, an independent body that brings together data protection authorities from each of the EU’s 27 countries and the EU’s executive European Commission, said it needed to examine Google’s plans more thoroughly before the search group’s policy comes into effect on March 1.
The European commissioner in charge of data protection, Viviane Reding, welcomed the move, saying it was a necessary to establish that EU data rules were being firmly applied.
Lawmakers and civil liberties groups in the United States are also concerned by Google’s plans to include photos and posts from users’ Google+ accounts in search results.
On January 13, the U.S. Federal Trade Commission added Google+ to a long running probe into how the company conducts searches after complaints by the civil liberties lobby, the Electronic Privacy Information Centre (EPIC).
The EU’s competition authority launched an investigation into Google search in December 2010 after French rivals complained they were being unfairly ranked by the search giant.
On Thursday, EPIC also filed a Freedom of Information Act request demanding that Google release its annual privacy audit.
“Google promises access to the world’s information, but it has not made available to the public the report it submitted to the Federal Trade Commission,” said Marc Rotenberg, EPIC’s executive director.
Google said the concerns raised by European regulators were a surprise.
“We briefed most of the members of the working party in the weeks leading up to our announcement,” said Al Verney, Google’s spokesman in Brussels.
“None of them expressed substantial concerns at the time, but of course we’re happy to speak with any data protection authority that has questions.”
The new policy seeks to explain what information Google collects from the millions of people who use its services every day, why it is collected, how it is used and what choices are then offered to limit how it is accessed and updated.
Google is not obliged to wait for the conclusion of the Article 29 Working Group’s investigation before adopting its new policy, but has in the past sought to work with European authorities when they have raised concerns.
The move by the EU regulators comes days after the European Commission set out legislative plans to overhaul its 17-year-old data protection rules, putting in place much more stringent policies on the protection of individual’s data.
Editing by Luke Baker, Helen Massy-Beresford and Mark Potter