The Spanish Agency for Data Protection (AEPD) said Google had committed three serious breaches of Spain's privacy law with each of those infractions being fined to the tune of €300,000.
Google had illegally collected and used personal data via over 100 services in Spain without adequately informing about users what that information would be used for, the AEPD stated.
In its ruling, the agency cited the example of Google's failure to advise users of the Gmail email service that email messages and attachments would be 'filtered' so that the firm could insert individualized publicity.
The data protection agency also took Google to task for using terms like "will be able to" or "it is possible that" in its privacy rules.
It also accused Google of keeping the data for longer than is legally justified and of making it difficult for users to query the use of their data.
Google spokespeople could not immediately be reached to comment to AFP on Thursday but El Pais newspaper quoted the company as saying it had been "totally involved" in the agency's investigations.
It would "read the report carefully and then decide what steps to take next", the newspaper quoted Google as saying.
The Spanish authority launched proceedings against Google in June. In September, France too said it would take action against the company, accusing it of breaching privacy norms.
Authorities in Germany, Italy, The Netherlands and Britain have also opened parallel procedures against Google.
The Spanish agency said it was the first of these six authorities to make a final decision on action against the US giant.
The European Union warned Google in October 2012 that its new data protection procedures did not comply with an EU directive on the subject and gave the company four months to change them.
That deadline passed without any action, prompting France to set up the task force of individual member states pursuing the issue with Google.
Google has defended the changes it made last year, saying they simplify and standardize its approach across its various services.
Critics say the policy gives the operator of the world's largest search engine unprecedented ability to monitor its users.
Like other technology giants, Google has come under heightened scrutiny in recent months following revelations by US whistleblower Edward Snowden of online eavesdropping by intelligence agencies.
The Spanish Data Protection Agency is a state body with power to impose fines and to order data to be destroyed, according to its website.
In 2010 it filed a suit against Google for allegedly capturing data from Internet users when it collected photos for its Street View map service.