EU Regulator: IP Addresses are Personal Data
BRUSSELS, BELGIUM — In a move that could have far-reaching implications for search engines and other online entities that track and/or retain the IP addresses of their visitors, the head of the European Union’s data-privacy regulators on Monday said the strings of numbers that identify individual computers on the Web should be considered personal information.The regulators are preparing a report about how well Google, Yahoo!, Microsoft and other search engines comply with E.U. privacy laws, which are much more restrictive than those in the U.S.
An IP address “has to be regarded as personal data,” Germany’s data-protection commissioner, Peter Scharr, told a European Parliament hearing.
In marked contrast, Google — which still needs approval from European regulators in order to complete its planned acquisition of online advertising network DoubleClick — insists an IP address merely identifies a machine’s location on the network and not an individual user.
However, although Google’s position may be correct in the case of public computers at internet cafes, libraries, and other similar spots, the recent emergence of “whois” websites that allow users to type in an IP address and retrieve the name of the person or company associated with it concerns the European privacy group.
In a move to address mounting public concern about the way it stores and uses data about its visitors, Google last year cut the length of time it saves search data from “indefinitely” to 18 months. It also reduced the length of time its cookies store data about users’ surfing habits from 30 years to two years.
Google doesn’t actually destroy the data it obtains: It merely “obfuscates” IP addresses associated with the data by truncating the last two digits, a move a privacy advocate at the Electronic Privacy Information Center called “absurd,” according to the Washington Post.
“It’s one of the things that make computer people giggle,” EPIC Executive Director Marc Rotenberg told the Post. “The more the companies know about you, the more commercial value is obtained.”
Google defends its data-retention policies by saying it needs to gather as much information as it can about users in order to improve its search results and help advertisers eliminate “click fraud.”
Another European data-protection regulator, Spain’s Artemi Rallo Lombarte, criticized all the search engines for failing to make their privacy policies easily accessible to users, both in terms of their locations within the websites and the language in which they are written.