So it’s reassuring to learn that the company has agreed to cut the time for which it retains users’ personal search data to 18 months from 18 to 24 months. The move is a concession to the Article 29 Working Party, the European Commission’s advisory group on privacy protection, which last month expressed concern over Google’s plan to retain user data for up to two years (PDF). “After considering the Working Party’s concerns, we are announcing a new policy: to anonymize our search server logs after 18 months, rather than the previously established period of 18 to 24 months,” Peter Fleischer, Google’s global privacy counsel explained. “We believe that we can still address our legitimate interests in security, innovation and antifraud efforts with this shorter period. However, we must point out that future data-retention laws may obligate us to raise the retention period to 24 months. We also firmly reject any suggestions that we could meet our legitimate interests in security, innovation and antifraud efforts with any retention period shorter than 18 months.”

Google’s policy change, while certainly a step in the right direction, likely won’t be enough to sate privacy advocates who’ve in the past called for it to scrub user logs in 18 to 24 hours, not months. Still, it’s better than that of Yahoo and Microsoft, which have so far declined to disclose their data-retention policies at all. This begs the question: Why haven’t we heard anything about the Working Party’s letters to those two companies? Insufficient postage for airmail?