The data protection office in the city of Hamburg said it had told Google to make "the necessary changes" so that the use of its German users' data is on a "permissible legal basis".
At issue is Google's compilation of user profiles drawing on data of Internet users such as their age or family background without their authorisation.
The Hamburg data protection officer handles the matter because Google's Germany operation is based in the northern port city but the office's decisions apply nationwide.
Its order confirmed an earlier decision last year which Google had appealed.
It said it had taken on board some of the objections raised by Google and adapted the order accordingly but that the appeal was mainly rejected.
Google faces a fine if it doesn't comply and has a month to possibly lodge a complaint with an administrative court.
In Germany, privacy concerns are particularly sharp due to gross violations under the Nazi and communist dictatorships.
EU anti-trust regulators have been probing Google since 2010 over its grip on Europe's Internet search market.
Catch the latest from the Consumer Electronics Show on Gadgets 360, at our CES 2026 hub.