The move has been a long time coming. The ICO gave Google an 80-day deadline to change its policy back in July 2013; a deadline which came and went without action.
Google first introduced the new policy in March 2012, but immediately came under fire from data protection regulators, privacy groups and the European Commission.
While conducting its own investigation, the ICO – which branded the policy “too vague” – has worked with other European Data Protection Authorities, as part of the Article 29 working party.
ICO head of enforcement Steve Eckersley said: “This undertaking marks a significant step forward following a long investigation and extensive dialogue. Google’s commitment today to make these necessary changes will improve the information UK consumers receive when using their online services and products.
“While our investigation concluded that this case hasn’t resulted in substantial damage and distress to consumers, it is still important for organisations to properly understand the impact of their actions and the requirement to comply with data protection law. Ensuring that personal data is processed fairly and transparently is a key requirement of the Act.
“This investigation has identified some important learning points not only for Google, but also for all organisations operating online, particularly when they seek to combine and use data across services. It is vital that there is clear and effective information available to enable users to understand the implications of their data being combined. The detailed agreement Google has signed setting out its commitments will ensure that.”