Searched and Seized
Users who are concerned about privacy also need to know details about what every business actually does with their information. Take Internet searches, for example.
Once you get your search results, you forget about the search and move on. Search companies don't forget. They store those searches, often along with an identifier showing who ran the search; how well the firm safeguards your data varies by search engine.
The important questions, Hoofnagle says, are: "How long will the data be kept, for what purposes will it be used, and what do [the companies] do when the police come knocking on the door?"
A case in point: The U.S. Department of Justice recently sought "a massive amount of information from Google's search index, and [ordered Google] to turn over a significant number of search queries entered by Google users," according to court documents. The Justice Department subpoenaed several search engines for information in defense against a lawsuit brought against the U.S. Attorney General's office over the Child Online Protection Act. According to the Justice Department and the judge's ruling, AOL, Microsoft, and Yahoo all complied with the request at least in part. In fact, many companies' privacy policies state that they will give the government data if asked.
Google fought, and won. Sort of. The judge ruled that the government could have a list of some site addresses found in Google's index, but denied the demand for search terms. The government had not asked for information that might have specified who conducted each search, but U.S. District Judge James Ware noted several potential privacy risks related to search strings, such as in the case of a "vanity search" where someone might look for data about themselves. And he highlighted a potentially serious privacy concern with searches run by a third party about another party, such as "[name] third trimester abortion san jose."
Google doesn't disclose its data retention policies, and it didn't respond to our questions about those policies. But Hoofnagle says that data older than 180 days can be subpoenaed more easily than newer info. Google cookies last over three decades on your PC.
Like Google's searches, Yahoo's use a cookie with a unique code; each search is tied to that identifier. The code isn't linked to personal data, like your age or location, but if you search while logged in to Yahoo, that search is tied to your Yahoo profile.
Yahoo stores those search details "for as long as it's useful," says spokesperson Nissa Anklesaria. And they're useful indeed. Yahoo's successful finance site came about in part because the firm saw many people running searches for financial information. However, Yahoo keeps your personal details to itself: Even when Yahoo works with third parties on ad campaigns and special offers aimed at users, it never gives user data to its partner, Anklesaria says.
Ad Choices