The data protection office in the city of Hamburg said it had told Google to make "the necessary changes" so that the use of its German users' data is on a "permissible legal basis".
At issue is Google's compilation of user profiles drawing on data of Internet users such as their age or family background without their authorisation.
The Hamburg data protection officer handles the matter because Google's Germany operation is based in the northern port city but the office's decisions apply nationwide.
Its order confirmed an earlier decision last year which Google had appealed.
It said it had taken on board some of the objections raised by Google and adapted the order accordingly but that the appeal was mainly rejected.
Google faces a fine if it doesn't comply and has a month to possibly lodge a complaint with an administrative court.
In Germany, privacy concerns are particularly sharp due to gross violations under the Nazi and communist dictatorships.
EU anti-trust regulators have been probing Google since 2010 over its grip on Europe's Internet search market.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.