Google has made some small concessions to privacy concerns raised by an EU working group, and has promised to make its log files anonymous after 18 months. 

The Article 29 Working Party expressed concerns in May about Google's data retention policies.

The search firm retains data for 18 to 24 months before it is 'anonymised'. The working party questioned why Google needed the data for that long, and asked the company to clarify how it uses the information.

"After considering the Working Party's concerns, we are announcing a new policy to anonymise our search server logs after 18 months, rather than the previously established period of 18 to 24 months," said Google global privacy counsel Peter Fleisher.

Fleisher's letter to Article 29 Working Party chairman Peter Schaar can be seen here (PDF). The original complaint can be seen here (PDF). 

But he also warned that future data retention laws may require Google to store data for 24 months.

The search company may also shorten the expiration period for cookies, but will seek to do so without requiring users to re-enter basic preferences such as preferred language.

EU regulations dictate that data should be stored "in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the data [was] collected or for which [it is] further processed".

Google stores past user queries for analysis and security reasons, according to Fleisher, allowing the firm to improve the quality of search results and track down click fraud.

"We firmly reject any suggestions that we could meet our legitimate interests in security, innovation and anti-fraud efforts with any retention period shorter than 18 months," he added.

Google was ranked at the bottom of Privacy International's ranking earlier this week.