In a report, "Opinion on data protection issues related to search engines," the EU's Article 29 Data Protection Working Party said search engines should expunge IP addresses and other data that can be linked to individuals as soon as the search companies no longer need it, with an outer limit of six months. After that, companies should delete the logs or "anonymize" them, provided that the anonymization is "completely irreversible."

The report, dated April 4, was posted on a Netherlands Web site. The EU has not yet issued new rules, but is expected to follow the Working Party's recommendations when doing so.

The EU's rules apply to companies doing business in Europe, and won't necessarily force Google and other search engines to change how they store information collected from U.S.-based Web users. In the past, however, Google has said it would implement privacy changes made in response to pressure from European regulators in the U.S. as well.

Google's global privacy counsel, Peter Fleischer, said in a post on the company's public policy blog that the Article 29 party's findings "are another important step in an ongoing dialogue about protecting user privacy online -- a discussion in which Google will continue to be engaged."

He added that Google disagrees with the Working Party's conclusion that IP addresses are considered personally identifiable information. "Based on our own analysis, we believe that whether or not an IP address is personal data depends on how the data is being used," he wrote.

Microsoft's EU Internet Policy Director Thomas Myrup Kristensen also said in a statement that the company believes "it is important to implement a range of privacy protections for search" and would work with the EU regulators.

Yahoo Director of Public Affairs Kelley Benander said the company was reviewing the report. "We remain committed to striking the right balance between protecting user privacy, providing the most compelling online experience, meeting our legal obligations and preventing fraud."

Google maintains it needs to store users' queries by IP address to improve its search algorithms and combat click fraud. But the report was skeptical about those rationales.

"It is the opinion of the Article 29 Working Party that search queries do not need to be attributable to identified individuals in order for them to be used to improve search services," regulators wrote.

As for click fraud, the regulators urged search engines to use anonymized data or develop other more "privacy-friendly" accounting systems. "Accounting requirements cannot justify systematic logging of normal search engine data in which the user did not click on a sponsored link," the group wrote.

When the EU cleared Google's merger with DoubleClick last month, regulators said the company would have to comply with European privacy policy. News last year of the impending merger sparked privacy advocates to complain that Google could combine its data about users' search history with DoubleClick's information about Web sites visited to compile extremely detailed user profiles.

Jeffrey Chester, founder and executive director of the advocacy group Center for Digital Democracy, cheered the report. "When serious people approach this issue they get to the facts and come to the right conclusion,' he said.

Google already has changed some data retention policies in response to pressure from European authorities. Last June, Google said would reduce the time it kept logs to 18 months, after which it will anonymize the data by deleting the last two digits. Microsoft said last year it would keep IP addresses for 18 months and then delete them, while Yahoo retains IP addresses for 13 months.

European regulators said in the new report that simply removing two digits of an IP address "may not always be enough to guarantee anonymization."

This news story is important. I recommend that everyone read it.