Yahoo to anonymize user data after 90 days

This was originally posted at ZDNet's Between the Lines.

Yahoo said Wednesday that it will make its user logs anonymous within 90 days as it ups the ante on data retention policies.

In a statement, Yahoo said it would also make user data on page views, page clicks, ad views, and ad clicks anonymous as well as its user logs. The only exceptions would be for "fraud, security, and legal obligations."

Clearly, Yahoo, Google, and others are racing to the bottom on data retention policies. In particular, Google and Yahoo have been playing a game of privacy leapfrog.

In September, Google said it would make its user logs anonymous after 9 months, a vast improvement over its previous 18-month policy. Google, which was pressured by regulators, said that 9 months was a good balance between "sometimes conflicting factors like privacy, security, and innovation." In July 2007, Yahoo went with a 13-month purge policy.

Anne Toth, Yahoo's head of privacy, said that 90 days was the minimum time it needed to retain user data for business purposes. Yahoo reached that conclusion after a review of its data policies across the globe and consulting business, engineering, governance, and product teams.

As for the exceptions Yahoo said:

To protect users and our business partners, there will be some specific and limited exceptions to the anonymization policy. In order to fight fraud and preserve system security, Yahoo will retain system specific data in identifiable form for no more than 6 months--but only for this purpose. Yahoo may have to retain data for longer periods to meet other legal obligations.

[pjhenry1216]

"in identifiable form for *no more* than 6 months ... Yahoo may have to retain data for longer periods"
(emphasis mine)

At what point does "no more" cease to have meaning?

And what business purposes require holding on to user identifiable information? why can't it be anonymized immediately?

[humanssssss]

It's paradoxical to say they anonymize after 90 days. Then they go on to say "Yahoo may have to retain data for longer periods to meet other legal obligations."

So they are saying, today they anonymize the data, tomorrow they unanonymize the data. Are they suggesting that they keep two sets of data. One they anonymize, another unanonymize.

[Wak_Em]

I know there is a point in there somewhere...unless it was anonymous.

[upuaut]

One immediate benefit to anonymization, if it truly is done, is the reduction in storage space needed. This would fit yahoo since it'd save them few bucks here and there in storage.