European regulators are recommending that search engines delete personal search data after six months, however most search companies keep the data much longer.
A report from the European Commission's Article 29 Data Protection Working Party found that search engines from companies such as Google, Yahoo and Microsoft, violate European data protection rules because they keep users' personal search data far too long. The length of time the data is kept differs, but ranges from 18 months to indefinitely.
The report also found that these companies don't tell users that their stored search queries and clicks help target advertising to them.
The report looked at whether the data-handling policies of search companies complied with European regulations, such as the Data Protection Directive. An individual's privacy, the report noted, is at the heart of European data protection laws.
"An individual's search history contains a footprint of that person's interests, relations, and intentions," the report said. "These data can be subsequently used both for commercial purposes and as a result of requests and fishing operations and/or data mining by law enforcement authorities or national security services."
The report recommended that search engines either delete personal search data or make it anonymous after no more than six months.
"In case search engine providers retain personal data longer than six months, they will have to demonstrate comprehensively that it is strictly necessary for the service," the report said.
The report said some search engines retained the data indefinitely, which is prohibited under European regulations.
Google said today it has responded to concerns over search data, and that it was the first company to makes its search logs anonymous. The company also changed the expiration times of small data files it places on PCs, known as cookies, which enable a Web site to remember a user's particular preferences.
"Protecting users' privacy is at the heart of all our products," said Peter Fleischer, Google's global privacy council, in a statement.
Yahoo said it was reviewing the working party's report, but that it is committed to providing clear and comprehensive privacy policies. Microsoft could not be immediately reached for comment.
The working party report will be used by the commission as it studies data protection practices.
Information from the IDG News Service was included in this story.