A new report from Privacy International puts Google at the bottom of the pile:

In the closing days of our research we received a copy of supplemental material relating to a complaint to the Federal Trade Commission concerning the pending merger between Google and DoubleClick. This material, submitted by the Electronic Privacy Information Center (EPIC) and coupled with a submission to the FTC from the New York State Consumer Protection Board, provided additional weight for our assessment that Google has created the most onerous privacy environment on the Internet. The Board expressed concern that these profiles expose consumers to the risk of disclosure of their data to third-parties, as well as public disclosure as evidence in litigation or through data breaches. The EPIC submission set out a detailed analysis of Google's existing data practices, most of which fell well short of the standard that consumers might expect. During the course of our research the Article 29 Working Group of European privacy regulators also expressed concern at the scale of Google's activities, and requested detailed information from the company.

The report lays it on Google, but they're not the only poor performers. In fact, no company received the top "Privacy-friendly and privacy enhancing" rating. The BBC, eBay and last.fm managed the second best "Generally privacy-aware but in need of improvement" but the rest of the pack fell far short of having a convincing and trustworthy story on privacy.