Google has been forced to change its privacy policy in the UK following a three-year investigation by the country's data privacy watchdog—but the company has avoided a fine.

The Information Commissioner's Office (ICO) found that Google was "too vague" when describing how it used people's personal data and has ordered it to make substantial changes.

In March 2012 the company combined around 70 existing privacy policies into one. It was a move that caused concern amongst privacy advocates, who said that it was no longer clear how people's data was collected and shared.

The changes meant that Google could collect user data on one service and use it on another—from Google Search to YouTube, for example. The ICO originally demanded Google change its privacy policy in July 2013, but the case became bogged-down in negotiations.

Regulators elsewhere in Europe were quicker to act and handed out harsher punishments. In December 2013 Spain levied a maximum fine of €900,000 (£751,000) against Google for breaking data protection laws. A year later the Dutch data watchdog threatened to fine Google €15m (£12m) if it didn't update its privacy policy by February 2015.

The Italian privacy watchdog ordered Google to make changes in July 2014 with French authorities fining the company €150,000 (£112,000) last January and demanding a change to its privacy policy. The French watchdog also forced Google to display a message on its homepage explaining that it had been fined for violating national privacy laws.

A spokesperson for the ICO told WIRED UK that each country looked at Google's privacy policy "under their own laws". When asked why the ICO had stopped short of fining Google the spokesperson said that it had based its conclusion on the UK's data protection act and added it could not comment on what other countries had done.

Concluding its three-year investigation the ICO said that it is crucial that companies better explain how user data is being handled. The watchdog added that Google's combined privacy policy did not provide "sufficient information" on how personal data was being collected.

"It is vital that there is clear and effective information available to enable users to understand the implications of their data being combined," said Steve Eckersley, head of enforcement at the ICO. "The detailed agreement Google has signed setting out its commitments will ensure that."

The company must make substantial changes to its privacy policy in the UK by 30 June 2015. Google has also agreed that any further changes to its privacy policy over the next two years will be subject to user testing.