Partial Victory for Google; Larger Victory for Search Engine Privacy

The court issued a decision Friday on Gonzales v. Google, the case involving a DOJ subpoena for Google search queries. (Dan Solove has excellent coverage here.) In short, the judge ruled partially in favor of the government, ordering Google to turn over 50,000 random URLs from its index of the web. But the judge squashed the DOJ’s demand for 5,000 actual search queries (originally the DOJ wanted 1 month’s worth, then one week, and finally settled on asking for only 5,000 queries).

Google resisted this request, partially on grounds that it might violate the privacy of their users. The DOJ argued that it was only requiring the text of the search queries entered, not the identies of the users who entered them, and that therefore there was no privacy interest.

The judge ruled in favor of Google’s concern over search engine user privacy:

Although the Government has only requested the text strings entered, basic identifiable information may be found in the text strings when users search for personal information such as their social security numbers or credit card numbres through Google in order to determine whteher such information is available on the Internet. The Court is also aware of so-called “vanity searches,” where a user queries his or her own name perhaps with other information. . . . Thus, while a user’s serach query reading “[user name] stanford glee club may not raise serious privacy concerns, a user’s search for “[user name] thrid trimester abortion san jose,” may raise certain privacy issues as of yet unaddressed by the parties papers. This concern, combined with the prevalence of Internet serches for sexually explicit material — generally not information that anyone wishes to reveal publicly — gives this Court pause as to whether the search queries themselves may constitute potentially sensitive information.

While the court came short of claiming search engine users had legal expectations of privacy in regards to their search queries (“The expectation of privacy by some Google users may not be reasonable”), this marks an important recognition that the content of one’s search queries might contain personal information that should be protected from government (or other third party) scrutiny. As Google itself reacts:

We will always be subject to government subpoenas, but the fact that the judge sent a clear message about privacy is reassuring. What his ruling means is that neither the government nor anyone else has carte blanche when demanding data from Internet companies. When a party resists an overbroad subpoena, our legal process can be an effective check on such demands and be a protector of our users.

(You can read the entire ruling here and the government’s original subpoena here.)