Major Search Engines Battle It Out on Privacy Protection

The new battle among Ask.com, Google, Microsoft, and Yahoo isn't about who has the best search. It's a duke-it-out over who will do the best job in preserving your privacy.

The competition began with Google's announcement earlier this year that it would modify saved search logs after 18 months so that particular searches couldn't be tied to specific people. That may not sound like a battle cry, but the other major search engines fired quick salvos in response to prove that they, too, care about your privacy. The planned changes vary in terms of what gets saved and for how long, but on the whole they should improve your privacy somewhat. But will they make a real difference? Or is it all PR?

"This is the most competition we've had in privacy in ten years," says Ari Schwartz of the Center for Democracy and Technology, referring to privacy-oriented changes in the works for saving search logs, serving targeted online ads, storing cookies, and working with content partners. The CDT is a Washington, D.C.-based think tank active on privacy issues, and consulted with the companies as they made their plans.

Schwartz says that while some updates, such as Google's plans for cookies, don't amount to much, others mark a definite positive change. In particular, Microsoft and Ask's plans to hold content partners to the same policies that Microsoft and Ask will use show that the companies are trying to take steps to improve the industry, he says.

"They know that there's concern about trust on the Internet," he says. "That makes real competition for privacy."

Less Optimistic

However, other privacy advocates--while welcoming the recent attention to how our personal information is stored and used--aren't nearly as optimistic about the recent announcements.

"I'm pleased to see that the companies are addressing privacy issues," says Marc Rotenberg, executive director of the Electronic Privacy Information Center, which is also located in Washington, "but I think they have a long way to go."

In addition, according to Rotenberg, these company announcements don't address another major privacy concern.

This concern is the trend for major search and ad company mergers, such as Microsoft's recently approved purchase of aQuantive, for example, and Google's proposed purchase of DoubleClick, which could mean extensive, consolidated databases chock full of personal information.

Revised Policies

According to Schwartz, the search companies all had changes in the works, but Google sparked the competition with its announcement that it would partially anonymize user search records, first saying that search records would be saved for 18 to 24 months, and then dropping that down to 18 months.

The search giant saves records of what you searched for, based on your computer's IP address and a unique identifier stored in a cookie. After 18 months, Google will pull the cookie ID from the search record and clear the final numbers from the IP address, which won't allow for tying searches to one person but will still allow the company to peg the general geographic location.

Other companies followed suit, partly to vie with Google, partly for compliance reasons, and "partly because they thought it was the right thing for them to do," says Schwartz.

Each of the announcements appeared meant to outdo competitors. Microsoft declared it would also anonymize search logs after 18 months, but would clear the entire IP address. And Yahoo leapfrogged the others by committing to a period of only 13 months.

Ask will anonymize logs after 18 months, but it pulls far ahead of other search companies with its plans for a new AskEraser service that will give users the option to prevent storing any search records. The company announced that "searchers' privacy settings will be clearly indicated on search results pages so they always know the privacy status of their searches."

Cookie Crumbles

These changes to search log retention, which should take effect by the end of the year, are generally welcome and could help reduce the chances for another data leak fiasco along the lines of AOL's release of 20 million Web search records last year.

But Google's plan for its cookies, which sounds like an improvement on the surface, isn't receiving such a warm welcome. The company says it will drop the expiration time for its cookies, which allow the company to tie a specific search to a unique identifier contained in the cookie, from 30 years down to 2 years.

However, "the two-year rule is not a particularly good one for privacy," Schwartz says. It's a mild improvement, but unlike now with the 30-year cookie, the two-year version will auto-renew every time you visit Google. That allows for a theoretical life-span well beyond three decades, given how often the average person runs a Google search--if a particular PC and browser actually stuck around that long.