Google announced today that it is planning to change its privacy policy in the coming months. The official announcement says: "Unless we're legally required to retain log data for longer, we will anonymize our server logs after a limited period of time [18-24 months]."
The general response from the privacy community is that this is a step in the right direction. For example, Kevin Bankston of the EFF called
But in this data retention FAQ posted by Google, the company says on page two that there will not be different log retention policies based on a user's country of origin. Google says: "We believe in applying this as a consistent policy for the benefit of our users worldwide."
In light of the 2006 European Union directive requiring member states to ensure that service providers retain certain data for a period between six months and two years, the new Google policy could mean that European countries will determine Google's retention period for the rest of the world -- including the United States. So privacy advocates may want to start paying closer attention to the implementing legislation currently circulating through capitals across Europe. Similar laws proposed in the US -- where arguments for a shorter period seem to have more traction than in the EU -- may not be such a cause for concern if the world's largest search engine adopts a universal retention policy matching the longest term required by a European country.