Could these profiles be used to tell companies whether or not people are good candidates for insurance or health care coverage?

I think that is a very obvious business opportunity for Google. And in some respects, it's even more attractive to Google than it is to companies that are currently in the business of managing medical health records, because under the HIPAA privacy rule, Google would not be considered a covered entity. They would not be subject to the privacy obligations that traditional health institutions are subject to under the federal regulation, which means that Google is, in effect, in the best position imaginable to exploit the data that it collects.

Let's say, for instance, that I've been using Google's search engine to look for information about a medical condition. How could that come back to haunt me?

Let's be specific: Let's say that the search phrase you use is "Ritalin and side effects" because like a lot of parents, you are trying to understand what the consequences might be for a child who is using Ritalin. Now, for an insurer, that is a red flag. And Google takes the position in regard to searches that it will hold the information for at least two years, and there are really no legal restrictions on what Google does with that information.

So here is this company in possession of personal information about millions of Internet users, and in certain contexts, it could clearly be stigmatizing -- and [Google's] view, as I said, is that there should be no restrictions on how that data might be used.