Privacy regulators in the Netherlands announced Monday that they have imposed an "incremental penalty payment" against Google for violating Dutch data protection law, which could be as much as €15 million ($18.7 million).

The Dutch data protection authority (DPA) specifically notes that the search giant's 2012 terms of service revision, which permits the company to combine user data across multiple services (Gmail, YouTube, and others), is against Dutch law.

Over a year ago, the Dutch data protection authority (DPA) found Google in violation of the law, but it has not explained the long delay in imposing the financial sanctions.

"Google catches us in an invisible web of our personal data without telling us and without asking us for our consent," Jacob Kohnstamm, chairman of the Dutch DPA, said in an English-language statement. "This has been ongoing since 2012 and we hope our patience will no longer be tested."

Google did not respond to Ars’ direct questions, but a spokesman did provide a statement.

“We’re disappointed with the Dutch data protection authority’s order, especially as we have already made a number of changes to our privacy policy in response to their concerns," Google spokesman Aaron Stein told Ars. "However, we’ve recently shared some proposals for further changes with the European privacy regulators group and we look forward to discussing with them soon.”

Specifically, the Dutch DPA demands that Google:

Will ask for the unambiguous consent of users for the combining of personal data from the different Google services. This can be achieved via a separate consent screen. Unambiguous consent can’t be obtained through information about this processing in the general (privacy) terms and conditions. Further clarifies the information in its privacy policy in order to provide clear and consistent information to people on which personal data are used by the different services of Google. Provides clear information about the fact the YouTube is part of Google. With regard to this last point, Google seems to have already taken measures in the Netherlands.

The agency also notes that the Dutch DPA has been given a new compliance deadline of February 28, 2015 before imposing the fine.