EU regulators are preparing a report on the privacy policies of Internet search engines, including those operated by Google, Yahoo, and Microsoft, and how well they comply with EU privacy laws. Peter Scharr, Germany's data-protection commissioner, heads the group and has said that an IP address must be regarded as personal data when it can be used to identify someone. Google disagreed in a hearing Monday before the European Parliament.

"If a law-enforcement authority makes a concrete request to, let's say, investigate child pornography, and if it is made through valid legal process, we respond to it," Peter Fleischer, Google's global privacy counsel, told the hearing on online data protection.

"The rules vary in each particular country," Fleischer said, "so this is why we have to face it with a good team of lawyers. We also challenged a disproportionate request for millions of pieces of information in a U.S. court, and we won."

Political Privacy Wrangling

The U.S. Federal Trade Commission has not come to a consensus on whether IP addresses should be defined as "personal data" subject to privacy rules. Fleischer maintains there is no black-and-white answer. Sometimes an IP address can be considered personal data and sometimes not, he said, depending on the context and what personal information it reveals.

Marc Rotenberg, executive director of the Electronic Privacy Information Center, disagreed. "I wish this was the case, but we are moving toward the IPv6 model, for which it will be even more the case that IP addresses will be personably identifiable," he told the European Parliament.

Google's proposed acquisition of DoubleClick underscores the need to take data protection into account, he continued. The Google-DoubleClick deal is currently being examined by the European Commission.

Fleischer said that the Internet would not be what it is without advertising. "We have to know who is consulting what -- otherwise our business would not work," he said, pointing out that the growth in services on the Internet is "partly due to advertising."

Should Google Be Doing More?

Microsoft backed Google at the hearing, but Thomas Nyrup, Microsoft's European Internet policy director, still stressed the need to ensure respect for the three principles of "consent, transparency, and security " because "the consumer must be able to check how his data is shared."

Ari Schwartz, deputy director of the Center for Democracy and Technology, said the European Union is working to clarify its definition of personal data. Different states have their own views about whether IP addresses are personally identifiable, he explained, and hearings like the one on Monday seek to draw the lines.

"Certainly, privacy is a major issue for Google. If they want to collect the world's information, they need to have some sense of what they are going to do with privacy, and it seems the rules are getting made up as we go along instead of having a broad provision," Schwartz said. "We expected a bit more from Google at this point. From the outside, we still don't see the broader vision for privacy."