"Google has a few months, three or four months, to comply. If it takes no action, we will enter a phase of litigation," said the head of France's CNIL data agency, which took a lead role in a European probe into the company.
It contends the move simplifies and unifies its policies across its various services such as Gmail, YouTube, Android mobile systems, social networks and internet search.
The CNIL led an investigation into the policy by data agencies from all 27 EU member states and on Tuesday presented its conclusions at a press conference in Paris.
In a joint letter to Google made public ahead of the conference, the agencies wrote that the US firm "provides insufficient information to its users, especially on the purposes and the categories of data being processed".
"As a result, a Google user is unable to determine which categories of data are processed in the service he uses, and for which purpose these data are processed," it said.
CNIL president Isabelle Falque-Pierrotin told reporters that "we now demand adjustments" to the policy, failing which "authorities in several countries can take action against Google".
She added however that such action would be taken on a national and not an EU level.
Critics have argued that Google's new policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the internet giant unprecedented ability to monitor its users.
The California-based firm said the changes are designed to improve the user experience across the various Google products, and give the firm a more integrated view of its users, an advantage enjoyed by Apple and Facebook.