The threat was made by the Dutch data protection agency (DPA), which said Google had broken local laws governing what it could do with user data.
The search giant has been given until the end of February 2015 to change the way it handles personal data.
Google said it was "disappointed" by the Dutch data watchdog's statement.
"This has been ongoing since 2012, and we hope our patience will no longer be tested," Dutch DPA chairman Jacob Kohnstamm told Reuters.
Privacy change
The row has blown up over the way that Google combines data about what people do online in order to tailor adverts to their preferences.
Information about keywords in search queries, email messages, cookies, location data and video viewing habits are all used by Google to build up a profile on each of its millions of users.
Dutch laws said Google should tell people about this data-gathering activity and get permission from them before it was combined or analysed, said Mr Kohnstamm.
A Google representative said "We're disappointed with the Dutch data protection authority's order, especially as we have already made a number of changes to our privacy policy in response to their concerns.
"However, we've recently shared some proposals for further changes with the European privacy regulators group, and we look forward to discussing with them soon."
The Dutch DPA was one of a group of six European data regulators that looked at Google following changes made in early 2012 to unify its privacy policies around the world.
Source: BBC News
