The ICO, which regulates data protection issues in the UK, found Google to be "too vague" when describing how it uses personal data gathered from its web services and products, and has forced the search giant to sign a formal undertaking to improve the information it provides to people about how it collects personal data in the UK.
Google's existing policy was introduced March 2012 and combined some 70 previous policies for various products and services.
The ICO ruled: "The new policy did not include sufficient information for service users as to how and why their personal data was being collected."
Steve Eckersley, the head of enforcement at the ICO, said: "This undertaking marks a significant step forward following a long investigation and extensive dialogue.
"Google’s commitment today to make these necessary changes will improve the information UK consumers receive when using their online services and products.
"While our investigation concluded that this case hasn’t resulted in substantial damage and distress to consumers, it is still important for organisations to properly understand the impact of their actions and the requirement to comply with data protection law.
"Ensuring that personal data is processed fairly and transparently is a key requirement of the act.
"This investigation has identified some important learning points not only for Google, but also for all organisations operating online, particularly when they seek to combine and use data across services.
"It is vital that there is clear and effective information available to enable users to understand the implications of their data being combined.
"The detailed agreement Google has signed setting out its commitments will ensure that."
Changes must be in place by 30 June 2015 and Google must take further steps over the next two years.