SAN FRANCISCO — Hopping on the privacy-protection bandwagon, Microsoft Corp. and Yahoo Inc. are limiting how long their Internet search engines retain potentially sensitive data about their users.

With the safeguards confirmed yesterday by Microsoft and Yahoo, all of the Internet's largest search engines have changed the way they handle the personal information collected about the millions of Web surfers who use their free services each day.

The search engines all appear interested in staying a step ahead of regulators as the industry mines personal data to customize online ads tailored for the tastes and interests of each individual visitor.

Those efforts have focused attention on the potential for intrusions into people's privacy if the data amassed by search engines is subpoenaed in a legal investigation or stolen by computer hackers.

The more sophisticated data mining also has prompted federal antitrust regulators and lawmakers to take a harder look at Internet search leader Google Inc.'s proposed $3.1 billion acquisition of ad-serving service DoubleClick Inc.

Privacy worries don't seem to have affected Web surfing habits so far, but that could change as people begin to see even more personalized online advertising and realize the search engines are profiling them, said Danny Sullivan, a veteran industry analyst and editor in chief of www.SearchEngineLand.com.

"If there were to be a big public outcry, that could hit (the search engines) in the pocketbook," Sullivan said.

The search engines all compile lists of requests being made by specific users with personal log-ins. But even for users who do not log in, the search engines track the requests coming in from individual computers based on their Internet addresses.

The search terms one uses can provide insights about that person's health, sexual preferences and other intimate details.

Historically, the major search engines have been vague about how long they hold on to the personal information.

Facing pressure from European regulators, Google got the privacy ball rolling in a new direction four months ago when it announced plans to remove key pieces of personal information about the search requests stored in its computers every 18 to 24 months.

Last month, Google narrowed its time frame for depersonalizing search requests to 18 months — a standard that's now being adopted by Microsoft, which runs the third most popular search engine.

Yahoo, the No. 2 search engine, will scrub the personal information within 13 months, the same duration adopted by Time Warner Inc.'s AOL, whose search engine ranks fifth in the United States, according to comScore Media Metrix. AOL spokeswoman Amy Call said yesterday the Web site adopted the 13-month standard late last year without publicizing the change.

InterActiveCorp's www.Ask.com, the No. 4 search engine in Media Metrix's standings, is going even further with a new tool that will allow people to block the retention of specific search terms and the Internet address identifying a user's computer.

Microsoft and www.Ask.com also called upon its rivals to join in a collaborative effort to establish industrywide standards.

"People should be able to search and surf online without having to navigate a complicated patchwork of privacy policies," said Peter Cullen, Microsoft's chief privacy strategist.

Contacted yesterday, representatives for Yahoo, Google and AOL reiterated their commitment to user privacy but gave no indication they would join Microsoft and www.Ask.com in a joint crusade.