The sanctity of the query

A search box is closer to a scratchpad than a public statement

People search before they know what they think. They test wording, investigate claims they distrust, look up symptoms they may not have, study ideologies they oppose, and explore possibilities they later reject. Treating each query as a stable declaration collapses the difference between asking and believing. 1

Inference makes query logs more sensitive, not less

The privacy problem is no longer limited to the literal words in a log. A sequence of searches can be combined with location, account history, device signals, reading behavior, and other data to produce second-order inferences about a person. Some inference is useful for relevance or fraud control. The liberty problem begins when those inferences become durable dossiers that travel into unrelated decisions. 2

Secondary use changes the meaning of collection

A service may need limited request data to answer a query, resist automated abuse, or diagnose failures. That does not establish a general license to retain the inquiry indefinitely, merge it with an advertising profile, repurpose it for unrelated eligibility decisions, or treat it as evidence of moral character. Purpose limitation is therefore a cognitive-liberty principle, not merely a storage preference.

Search privacy needs epistemic due process

If an automated system uses a query to restrict access, alter a risk score, or trigger a consequential review, the user should be able to understand what happened and contest material errors. The burden should rise with the consequence. A harmless relevance guess and a decision affecting access, employment, insurance, or law-enforcement attention are not ethically equivalent.

Design for the smallest necessary record

The safest query database is the one that was never created. Where retention is genuinely required, systems should separate identity from inquiry where possible, shorten retention, prevent unrelated reuse, and make deletion meaningful. Privacy is strongest when architecture makes misuse difficult rather than merely promising that powerful logs will be handled responsibly.