Yahoo limits personal info retention
Yahoo said Wednesday that it would limit to 90 days the time it holds some personally identifiable information related to searches to address growing concerns from privacy advocates, policy makers and government regulators.
Yahoo’s new data retention policy is the most restrictive among major search engines in the United States and will most likely put pressure on rivals like Google and Microsoft to shorten the time they keep information about their users.
It comes at a time when some privacy advocates are planning a renewed push for legislation that would regulate the data retention and online advertising practices of Internet companies, which they say has a stronger chance of passing with a new Congress and president in Washington.
Already Representative Edward J. Markey, a Massachusetts Democrat who is chairman of the House Subcommittee on Telecommunications and the Internet, praised Yahoo for setting a new privacy standard.
“I urge other leading online companies to match or beat the commitments announced by Yahoo,” Mr. Markey said in a press release.
Previously, Yahoo kept search logs for 13 months. In September, Google began to strip out some personally identifiable information related to searches after 9 months. Microsoft keeps the information for 18 months.
The strongest pressure on Internet companies so far came from European regulators who have been urging major search engines to reduce to six months the time they hold personally identifiable information.
Microsoft said last week that it would agree to such a standard if its rivals also went along.
Anne Toth, vice president of policy at Yahoo, said that the company chose an even shorter time period to “take the issue off the table.” Ms. Toth said she hoped that the new policy would make Yahoo’s search service more attractive with users concerned about privacy.
But it is not clear that stronger privacy protections will persuade consumers to switch to a different search engine. Last year, Ask.com introduced a new feature called AskEraser, which allows users to search anonymously. It has had little noticeable effect on the popularity of Ask.com. Google is the dominant search engine, handling about 63 percent of search queries in the United States, according to comScore.
Under the new policy, Yahoo will delete the last eight bits of the Internet Protocol, or I.P., address associated with a search query after 90 days. I.P. addresses are digital tags that can identify a specific computer. Yahoo will also hide cookie data related to each search log and strip out any personally identifiable information, like a name, phone number, address or Social Security number, from the query itself.
Yahoo also said that its new policy would extend to other types of data it collected, like page views, page clicks, ad views and ad clicks.
Major search engines have said they need to retain personal data, in part, to provide better services, like more targeted ads and more relevant searches. Ms. Toth said Yahoo determined it could begin scrambling the personal data after 90 days without affecting the quality of services it provided to users, advertisers and publishers.
Privacy advocates said that the new policy was a step in the right direction and credited the change to pressure from European regulators. But they said that Yahoo’s method of scrambling I.P. addresses by deleting their last eight bits was inadequate to guarantee privacy.
“That is not provably anonymous,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center. Mr. Rotenberg and other advocates said that companies should delete the entire I.P. address, an approach recommended by European officials. Currently, Microsoft deletes the entire I.P. address, while Google deletes only the last eight bits.
“Microsoft believes that the method of anonymization is more important than the anonymization timeframe and believes all major search engines need to adopt a high standard,” Brendon Lynch, director of privacy strategy at Microsoft.
Google declined to comment directly on Yahoo’s new policy but said it was “continually evaluating” how to balance the services it offered with the privacy of its users. Google had said previously that discarding personally identifiable data sooner than nine months would undermine the quality of its search engine and other services.
Source: New York Times