• by Wendy Davis  @wendyndavis, January 19, 2010

In a concession to European privacy regulators, Microsoft said today it will slash the time it retains IP addresses tied to users' search queries to six months. Previously, the company kept such data for 18 months.

"This change is the result of a number of factors including a continuing evaluation of our business needs, the current competitive landscape and our ongoing dialogue with privacy advocates, consumer groups, and regulators," chief privacy strategist Peter Cullen said in a blog post explaining the shift in policy.

Cullen specifically referred to regulators from the European Union's Article 29 Data Protection Working Party, which has been pressuring companies to comply with its recommendation to expunge any data that could be linked to individuals after no more than six months.

Yahoo recently said it will delete users' IP addresses after three months, while Google takes steps to anonymize searchers' IP addresses after nine months.

Google's global privacy counsel Peter Fleischer said today that the company plans to continue to keep information about searchers' IP addresses for nine months. "We're committed to using data both to improve our services and our security measures for our users and to protect their privacy, and we remain convinced that our current logs retention policy represents a responsible balance," he said in a statement.

Google argues that retaining IP logs can benefit users and advertisers by helping to combat click fraud and by improving the relevance of search results. For instance, many clicks on an ad from the same IP address can raise suspicions of fraud. As for relevance, the company says that logs can improve results because people's interaction with results over time plays a role in tweaking the search algorithm.

But privacy experts question whether the privacy risk posed by keeping search results for lengthy periods of time is worth an incremental improvement in relevance.

"At some point you need to think about proportionality," says Jules Polonetsky, co-chair and director of the think tank Future of Privacy Forum. "If you're going to get a micro increase, but create a massive increase in privacy risk, is it always worth it?"

For its part, Microsoft said it doesn't believe that shedding IP addresses will result in less relevant search results. "We are continually evaluating our data collection, use and retention practices in order to provide the most innovative products and services to our customers while also protecting their privacy," said Brendon Lynch, senior director of privacy strategy at the company. "We determined that we could enhance our existing anonymization processes without degrading the quality of our search results or our ability to improve them over time."