The letter, which stopped short of declaring Google's approach to collecting user data illegal, follows an investigation led by France's Commission Nationale de l'Informatique (CNIL) that began in February.
This consolidated 60 privacy policies into one and pooled data collected on individual users across its services, including YouTube, Gmail and its social network Google+. Users cannot opt out.
The regulators' letter said: "Combining personal data on such a large scale creates high risks to the privacy of users."
"Therefore, Google should modify its practices when combining data across services for these purposes," the letter said.
It was signed by 24 of EU's 27 data regulators plus those of Croatia and Liechtenstein.
Google declined to comment.
The first five cover how Google tells people about how their personal information and browsing records will be used, highlighting location data and credit card data in particular.
The regulators also want Google to spell out its intentions and methods for combining data collected from its various services.
They want the web search giant to ask users for explicit consent when bundling data together, the letter said.
The pooling of anonymous user data across Google services, is a big advantage when selling online ads.
Google and other large internet groups like Facebook provide free services to consumers and earn money from selling ads that they say are more closely targeted than traditional TV or radio campaigns.
"They may be prepared to test the legal position in Europe to see what they can get away with."
The tussle with the EU over data privacy comes at a delicate time for Google.
Europe's antitrust authorities are also examining the company's business model to see if it uses its clout in search advertising to favour its own services over competitors' offerings. Google is in talks with EU regulators on the case, and could offer concessions.
(Reporting by Claire Davenport, Leila Abboud and Gwenaelle Barzic; Editing by Rex Merrifield and Jane Merriman)