Yahoo rolls out new data-retention policy


This article was originally on a blog post platform and may be missing photos, graphics or links. See About archive blog posts.

Search engines are now competing to win the privacy PR war.

Amid mounting concern from regulators and watchdogs in Washington and Europe that large Internet companies are compromising their users’ privacy by keeping data about online behavior for too long, Yahoo said today that it would shorten that time from 13 months to 90 days.

Google halved the time it keeps such records in September to nine months. Microsoft, which keeps such data for 18 months, said last week it would support an industry standard of six months.


Yahoo’s new policy will apply not just to data from searches but also to data collected for advertising purposes, the Sunnyvale, Calif., company said.

‘We think this is a great step forward in self-regulation,’ said Anne Toth, Yahoo’s vice president for policy and head of privacy. Toth added that the move differentiates Yahoo ...

... from its competitors and will build trust with users.

It also could pressure Google and Microsoft to follow suit.

Google could not be reached for comment. Brendon Lynch, Microsoft’s director of privacy strategy, released a statement:

‘Microsoft believes all major players in the market should move to effective privacy practices and welcomes Yahoo’s steps on search anonymization following Microsoft’s call for an industry standard last week. Microsoft believes that the method of anonymization is more important than the anonymization timeframe and believes all major search engines need to adopt a high standard.’

Yahoo said it would remove portions of users’ IP addresses, change ‘cookies’ and delete other potentially personally identifiable information after 90 days, except in cases involving fraud and data security. It will begin implementing the new policy next month, but it won’t take effect across all of the company’s services until mid-2010.

A group of European officials, called the Article 29 Data Protection Working Party, had asked search engines to expunge user data after six months to protect consumers. Congress has also been investigating how technology companies track their users. Edward Markey (D-Mass.), chairman of the House Energy and Commerce subcommittee on telecommunications and the Internet, praised Yahoo’s new policy.

‘I urge other leading online companies to match or beat the commitments announced by Yahoo,’ Markey said in a statement.


Privacy advocates welcomed the move but challenged Yahoo and other search engines to make public the process they use to make personal information anonymous. They say the search engines do not need to keep the data for so long. Case in point, they say, are the inconsistent messages the industry has sent about just how long it needs to keep data. Watchdogs also want more clarity from Internet companies on what they do with the data.

‘It’s always good to see search companies competing to provide more privacy to their users,’ said Electronic Frontier Foundation senior staff attorney Kevin Bankston. ‘However, you can’t judge the true privacy impact of the change until you know the exact steps the companies are taking to anonymize the data. The devil is in the details. If the anonymization process is not robust enough, this is more privacy PR than privacy protection.’

-- Jessica Guynn