Google reveals why and which information they retain in a blog post on their Official Google Blog.
It goes to show, pretty much any search gets retained with it’s originating IP address, and how it relates within an entire stream of searches from the same user (using cookies or hidden fields or whatnot).
They’ll keep it around between 12 and 24 months, for the worlds law enforcement agencies to ask for.
Although they’re not actively associating a person’s identity with the queries (unless they have a Google account), I’m sure law enforcement will overlook that "minor" issue and demand proof that folks have no idea how Bad Query Guy’s Google cookie got on their machine.
Innocent until proven guilty by search engine.