That gives Google a powerful tool for targeting the user with advertising based on his or her interests and search history. Advertising is the main way the company makes its money.
The collection of data is not just limited to people with accounts to Google applications. The web giant can collect information from anyone who visits a website that has a link to its services - for example, a Google map posting. The commission said that of the top 500 most-visited sites in France, 90 percent had a link with Google.
With that kind of power, comes responsibility, the commission said.
It outlined three main concerns about the new policy: it's not clear enough in explaining to users what data is collected and how it will be used; it's too difficult for users to opt out of data collection and combination; and Google doesn't always say how long it will hold onto data.
The commission also noted that, under the new policy, Google doesn't differentiate between data collected, so a search term and a credit card number are treated the same and can be used for any purpose stated in the policy.
Regulators want Google to flesh out the vague parts of its policy, tailor the way it uses data to the kind of data collected and, in general, make it easier for users to wriggle out of the wide net it has cast.
All of these concerns and suggestions were sent to Google in a letter Tuesday, although the findings were presented to Google representatives last month. Data protection authorities in all 27 European Union countries signed the letter.
Google's global privacy counsel, Peter Fleischer, said the company is reviewing the commission's report but believes its policy respects European law.
Isabelle Falque-Pierrotin, president of the French National Commission on Computing and Freedom, said that Google would have three to four months to respond but that there wasn't a firm deadline.
"We haven't asked Google to go back to its old policy," she told reporters. "We've asked it to complete and clarify it on a certain number of points."
If it fails to comply, she said regulators could move into a more "contentious phase" - but wasn't clear on exactly what that would entail. Data regulators in many of the countries represented have the power to fine companies, but the response would vary by country.
"You have to understand the approach of the data protection authorities: It's not to make war with Google and to stop all innovation," she said. "It's to say: You are a dominant actor in the market. You have to take up your responsibilities."