"Google is ordered to take the necessary technical and organizational measures to guarantee that their users can decide on their own if and to what extend their data is used for profiling," the data protection commissioner for the German city state of Hamburg said in a statement on Tuesday.
Commissioner Johannes Caspar said that Google previously had refused to grant users more control over how it aggregates data across its services including Gmail, smartphones operating system Android and the web search engine.
Processing data that reveals financial wealth, sexual orientation and relationship status, among other aspects of private life, is unlawful in Germany unless users give their explicit consent, it added.
Google spokesmen in Europe did not immediately respond to requests by phone and email for comment.
The Financial Times earlier quoted a company spokesman as saying Google was studying the order to determine next steps.
European data privacy regulators last week handed the U.S. group a package of guidelines to help it bring the way it collects and stores user data in line with EU law.
Regulators in six European countries, Italy, France, Spain, Germany, Britain and the Netherlands, have opened investigations into Google after it consolidated its 60 privacy policies into one and started combining data collected on individual users across its services, including YouTube, Gmail and Google Maps.
(Reporting by Ludwig Burger, editing by William Hardy)