From The Guardian:

Google has been given 18 months by the Italian data regulator to change how it handles and stores user data.

Users will now have to grant permission before the firm creates a profile on them, and Google has to honour requests to delete data within two months (although it will have an additional six months to remove the content from backups). Google will also have to explicitly inform users that the profiles it creates on them are for commercial purposes.