[Infowarrior] - Yahoo Limits Retention of Personal Data

[Richard Forno]

December 18, 2008
Yahoo Limits Retention of Personal Data
By MIGUEL HELFT

http://www.nytimes.com/2008/12/18/technology/internet/18yahoo.html?_r=1&pagewanted=print

SAN FRANCISCO — Yahoo, the Internet search company, said Wednesday  
that it would limit the time it holds identifiable personal  
information related to searches to 90 days to address the growing  
concerns of privacy advocates and government regulators.

Yahoo’s new data retention policy is the most restrictive among major  
search engines in the United States and is certain to put pressure on  
rivals like Google and Microsoft to shorten the time they keep  
information about their users.

Previously, Yahoo kept search logs for 13 months. In September, Google  
began to strip out portions of the personally identifiable information  
related to searches after nine months. Microsoft keeps the information  
for 18 months.

European regulators had been asking major American Internet search  
engines to reduce the time they hold identifiable personal information  
to six months. Microsoft said recently that it would agree to such a  
standard if its rivals also went along.

Anne Toth, vice president for policy at Yahoo, said that the company  
chose an even shorter time period to “take the issue of the table.”  
Ms. Toth said she hoped that the new policy would make Yahoo more  
attractive to users who were concerned about privacy.

“We certainly hope that taking a leadership position in this will  
differentiate us even further,” Ms. Toth said.

But it is not clear that stronger privacy protections are enough of a  
selling point with consumers to make then switch search engines. Last  
year, Ask.com introduced a new feature called AskEraser, which allows  
users to search anonymously, and which the company said would help it  
increase its audience. However, Ask.com’s share of the search market  
has remained relatively stagnant. Google is the dominant search engine.

Under the new policy, Yahoo will delete the last eight digits of the  
numeric Internet Protocol address associated with a search query after  
90 days. It will also alter so-called cookie data related to each  
search log and strip out any personal information, like a name, phone  
number, address or Social Security number, from the query. Yahoo also  
said that its new policy would extend to other types of data it  
collects, like page views, page clicks, ad views and ad clicks.

Major search engines have said they need to retain personal data, in  
part, to provide better services, like more customized ads and more  
personalized searches. Ms. Toth said Yahoo determined it could begin  
deleting certain data after 90 days without affecting the quality of  
services is provides to users, advertisers and publishers.

Privacy advocates said that the new policy was a step in the right  
direction and credited the change to pressure from European regulators.

“As much as the U.S. search firms talk about how they are improving  
their practices, I think they are really afraid that the Europeans are  
going to bring an enforcement action under European privacy laws,”  
said Marc Rotenberg, executive director of the Electronic Privacy and  
Information Center. “That’s where the push is really coming from.”

Mr. Rotenberg also said that stripping out eight digits from the I.P.  
address would not guarantee that queries would be anonymous. He  
compared it with stripping out the last two digits of a telephone  
number.

Under pressure from advocates and regulators, American search  
companies over the last 18 months have been gradually shortening the  
time they retain personal data. Still, they remain behind others. In  
the Netherlands, a small search engine called IXQuick has promised to  
delete I.P. addresses after 48 hours and was commended for doing so by  
European regulators.

Microsoft and Google could not immediately be reached for comment.