BERLIN, May 25 — Google has been warned that it may be violating European Union privacy laws by storing search data from its users for up to two years, the latest example of a United States technology giant whose practices face a collision with European standards.
An advisory panel of data-protection chiefs from the 27 countries in the European Union sent a letter last week to Google asking it to justify its policy of retaining data on Internet addresses and individual search habits, Friso Roscam Abbing, a spokesman for the European Union’s justice commissioner, Franco Frattini, said on Friday.
Privacy experts said the letter was the first salvo in what could become a determined effort by the European Commission to force Google to change how it does business in Europe, where the 400 million consumers outnumber those in the United States.
Any effort to impose limits on Google, which operates under United States law, would be the latest in a series of increasingly aggressive actions taken by European policy makers to rein in global technology companies.
Mr. Frattini called the working group’s query to Google “pertinent, appropriate and legitimate,” Mr. Abbing said.
According to one member, who spoke on the condition of anonymity because he was not authorized to speak for the group, the panel is concerned that Google’s retention period is too long and is intended to serve commercial interests. The data is often used to direct advertising to users.
“The discussion is only just beginning,” said Christoph Gusy, a privacy law expert at the University of Bielefeld in Germany. “The pressure to regulate this type of business activity, which is still in its infancy, is building, and what you are seeing is the beginning of a serious effort in Europe.”
Google described the committee’s request as reasonable. It noted that the company itself raised the issue with European officials in March by announcing that it was shortening the retention of customer data, which had previously been unlimited, to up to two years. Other large search engines like Yahoo and MSN Search have not disclosed how long they keep data.
“There can be reasonable arguments for and against keeping server logs for this length of time,” said Peter Fleischer, Google’s global privacy counsel. “But we believe that between 18 and 24 months is a reasonable length of time to balance privacy issues with business concerns.”
In a letter to be sent to the European Union panel, Google will argue that the retention periods are necessary to ward off hackers and prevent Internet advertising fraud, and to improve Google’s search algorithm, Mr. Fleischer said.
The panel plans to meet on June 19 in Brussels to consider Google’s response.
The most prominent European case against a United States technology giant focused on Microsoft, which the European Commission found in 2004 to have violated antitrust laws for using its de facto monopoly Windows operating system to promote its own server software and desktop media players. The company settled a similar case with American antitrust regulators in 1994.
Microsoft is appealing the commission’s decision. In the meantime, the commission and European competition officials have fined the company nearly $1 billion for failing to comply with the terms of its original order.
Some European nations are also challenging the operating practices of global technology companies, with success. In Britain, eBay this year agreed to modify its service after Britain’s information commissioner, Richard Thomas, complained that customers were not able to easily close accounts and wipe out trading logs.
Simon Davies, the director of Privacy International, a London-based advocacy group, said that Google was a leading target of complaints received by his organization last year.
Of the 10,000 complaints made to the group in 2006, 2,000 involved Internet-related activities. And of those, 96 percent were about Google and its practice of retaining customer data, Mr. Davies said.
“The E.U.’s action is the first shot in a long, potentially bloody battle with Google,” he added. “There is definitely a perception that something is amiss with Google.”
How far European officials can go to force Google to change its data-retention policies remains unclear. The European Union’s Data Retention Directive, which takes effect on Sept. 1, requires all telecommunications companies and Internet service providers to retain traffic data on users for up to two years.
But European law, according to Mr. Gusy, the German data retention expert, is silent on whether to apply the same limits, which are intended to combat terrorism, to content providers or search engines.
Mr. Abbing, the justice commissioner’s spokesman, said the commission could compel members to enforce the law.
How that could be used to challenge Google, whose business takes place largely in the Internet universe, is unclear. The data retention panel member said his group was hoping with its letter to persuade Google to voluntarily narrow its retention periods.
But François Bourdoncle, the chief executive of the French search engine Exalead, said European countries had the right to impose their own standards on the collection of Internet data.
“I think it is fair for the state to place boundaries around what a company may do with your private data,” Mr. Bourdoncle said. “We follow the very strict French privacy law that prevents us from storing any personal information that can be traced back to the individual.”
Mr. Bourdoncle said that the growing range of services offered by Google and other search portals posed an increasing threat to privacy. “By offering services from e-mail to search, they can easily build a complete profile of your entire digital life,” he said. “It is worrisome how much they can know simply by correlating all the information they collect on you.”
Yahoo declined to comment on the working group but said user trust was of high importance to the company.
Alex Laity, a spokesman, said Yahoo did not have a single policy on the issue. “Our data-retention practices vary according to the diverse nature of our services,” he said in an e-mail message.
Mr. Fleischer of Google noted that his company was the first of its kind to cut retention periods voluntarily, not just in Europe but around the world.
“We started this privacy dialogue precisely because we think it is something that needs to be further discussed,” he said.
i