Google said that from now on, it will store information relating to the IP addresses of users for nine months, while EU regulators consider six months as the standard.
An IP address is the identification number given by Internet service providers to every computer connected to the Web. Desktop computers usually keep the same IP address, but it tends to change with laptops as they are often used in different locations and thus use different service providers.
The key issue for regulators is to establish whether or not an IP address should be considered as personal data. If considered private, EU rules on data protection will apply and Google will be forced to request prior permission to users before storing this information. This would have a potentially huge impact on Google's current business model (EurActiv 09/04/08).
At the moment, however, EU legislation does not define the nature of an IP address as private or otherwise. The Data Protection Directive says private data is "any information relating to an identified or identifiable natural person".
But the European group of privacy protection authorities (Article 29 Working Party) in 2007 concluded that the IP address is related to an "identifiable person", and should thus be considered personal data. According to the group, Google would therefore need to ask users' prior permission before storing the information.
Experts at EU privacy bodies welcomed Google's move, hailing the "good news", but underlined that it still falls short of a request to reduce retention time to six months. Moreover, the issue of previous authorisation from users remains open, they said.
Nevertheless, they also concede that privacy concerns could become irrelevant if Chrome, the new Internet browser launched by Google this month, takes a significant share of the market. Chrome aims to merge browsing and searching and could make search engines outdated. One of the innovations introduced by Chrome is a so-called "incognito mode" whereby the browser does not store any personal data.
