Google has been given 18 months by the Italian data regulator to change how it handles and stores user data.

Users will now have to grant permission before the firm creates a profile on them, and Google has to honour requests to delete data within two months (although it will have an additional six months to remove the content from backups). Google will also have to explicitly inform users that the profiles it creates on them are for commercial purposes.

In a statement, the data watchdog said Google's disclosure to users remained inadequate, despite it having taken steps to follow local law.

A Google spokesman said "We've engaged fully with the Italian DPA throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services, and we'll continue to do so. We'll be reading their report closely to determine next steps."

It has also agreed to present a roadmap to the regulator by the end of September, showing how it will comply with the decision.

The command follows a cross-European investigation that found that the Californian company was in violation of the EU's privacy policy laws.

Italy's Data Protection Authority led the inquiry, which began after Google consolidated 60 of its privacy policies into one all-encompassing policy, covering services as varied as YouTube, Gmail and Google Search. Users were not given the ability to opt out of the consolidation.

That consolidation, which occurred in January 2012, eventually resulted in the company was told in July 2013 to rewrite its privacy policy or face sanctions.

Watchdogs from across Europe complained to the company, with the head of the UK's ICO saying that the new policy presented "serious questions" about compliance with the UK Data Protection Act. France and Spain also complained.

• European watchdogs order Google to rewrite privacy policy or face legal action