[flowerbreeze]

I think the line is well enough drawn in this particular case. It's not "my data", but PII (Personally Identifiable Information) that most of the legislation is concerned with.

Firstly, the search engine does not require a person's name, address, gender, mother's maiden name, person's dog's name, all people the person is associated with etc to perform a search. If someone inputs these to the search input, it's just a search parameter not something that the search engine can reliable use to identify and track the person. So, a search is fine to perform, using the text for improving the service is fine, using it to do anything at all is basically fine, but collecting personally identifiable information that would allow identification of the user that entered the search parameters and using it for whatever the company deems useful for their own purposes, is not. Not ok without explicit consent of the user that is or if required to provide the service. Or a number of other cases as listed in the appropriate legislation, including the following.

Secondly, (most?) legislation, as far as I know, exempts businesses from the requirement of obtaining explicit consent, if the PII containing inputs, are required to perform the service. That could include for example using IP address logging for security purposes against DDOS attacks. It could be PII, but if its processing is necessary to provide the service, that's ok. No extra consent required.

Another example, if you need an email address from a person to send an "email verification email" for a "forgot my password" feature, there is no need to obtain additional consent beyond stating why the email address is collected and then use it only for that purpose.

Basically, no funny business with the data, use it for what it's given and it's all fine. No need for extra poopups asking, "may I plz stalk you/sell all your dataz?", if that's not what is being done.

Note: This is my limited understanding, not an official or legal interpretation or anything.