How search engines rate on privacy

Price wars are public blessings. Ask anyone who has comparison shopped between Advanced Micro Devices and Intel microprocessors or bought a cheap Harry Potter novel thanks to fierce bookseller price battles.

In the last few months, the search engine business has experienced its own version of cutthroat competition: a privacy policy war, with Google, Ask.com and Microsoft vying to outdo one another in protecting their users' personal information.

But it's been difficult to make direct comparisons, in part because privacy policies tend to be written by lawyers for lawyers. So CNET News.com did some of the work for you by surveying the five leading search companies.

Starting on August 6, we asked them eight questions, including how long they retain search data, how they eventually dispose of it, whether they engage in behavioral targeting, and whether they use information they have from user sign-ups to guide which ads are displayed. We asked follow-ups where necessary for clarification.

The verbatim results of the survey are posted in an accompanying story.

Related story
In their own words

Top search engines answer
News.com's privacy survey.

The answers suggest that, based on the questions we asked, Ask.com was the most protective of user privacy. In fact, only Ask.com said it would not record what users type into its search engine. (Smaller search engines, including ixquick, said this as well, but we limited our survey to the five largest engines.) Ask.com also said it did not engage in behavioral targeting, which refers to the practice of offering advertisements based on previous searches.

And the rest? Results were mixed. Google avoids behavioral targeting, but after 18 months it performs a partial anonymization of users' Internet Protocol addresses--an action that's not terribly privacy protective. Google dominates the search market: 53 percent of U.S. Web searches in June were performed on its site, according to Nielsen/NetRatings.

Microsoft is better on the anonymization front. Peter Cullen, the company's chief privacy strategist, said users' Internet addresses and cookie values are "permanently and irreversibly" disassociated from the search terms after 18 months. But Microsoft does engage in behavioral targeting, while Google doesn't. Yahoo and AOL were similarly mixed.

These were, nevertheless, remarkable improvements. Google, Microsoft and Yahoo told News.com, in response to an earlier survey we did in February 2006, that they kept search records for as long as the data prove useful. Now they've set expiration dates, and Ask.com went further by promising to stop recording user search histories starting later this year. Google also has shortened the lifespan of its cookies from expiring in 2038 to expiring two years from the last visit.

Search privacy is important because our Googling (and Yahooing, and MSNing and so on) provides a unique glimpse into our personalities and private lives. Search terms have been used to convict a wireless hacker and lock up a man charged with killing his wife. Search engine activity is also a fertile growth area for nosy divorce lawyers and employment disputes.

One relatively simple way to protect your privacy when using search engines is to configure your browser to not permit them to place cookies on your computer. (Here's an FAQ on the topic.) Another way is to route all your connections through a proxy server such as Anonymizer, Tor or Black Box Search.

Market rivalry and regulatory threats
What all this amounts to is that the best search engine to use, from a privacy perspective, depends on what's most important to you.

Are you worried about a company publishing even anonymized search terms, as AOL did last year? Then use one that deletes your data sooner, or disable cookies for that site (at the price of not being able to use features like Web-based e-mail). Do you dislike seeing ads presented according to a computer-generated profile that was crafted based on your search terms? Then use Ask.com or Google, because the other three companies we surveyed do behavioral targeting. Worried about someone perusing your search history in person? Use software like PGP or Mac OS X's FileVault to encrypt part or all of your hard drive.

In addition to the normal forces of marketplace rivalry, another recent factor has been government regulatory threats. A group of European bureaucrats, called the Article 29 Working Party, has been pressuring search companies to store information for a shorter period of time. Last year, there was even a bill introduced in the U.S. Congress that would have forced Web sites to delete personal information if not required for "legitimate" business purposes.

Behavioral targeting is another growth area--not only for search companies, but for bureaucrats and politicians as well.

Google's proposed $3.1 billion acquisition of the DoubleClick ad company is being investigated by U.S. regulators after the purchase was challenged on competition and privacy grounds. Microsoft has received regulatory approval to buy online ad firm Aquantive, and Yahoo acquired online ad exchange Right Media. More recently, AOL said it was planning to acquire behavioral-targeting firm Tacoda.

The companies say they're following industry standards, with both Microsoft and Yahoo noting in our survey that they perform behavioral targeting only in accordance with Network Advertising Initiative principles. But liberal groups are becoming increasingly vocal, and the Federal Trade Commission last week announced it would hold a two-day forum in November to address behavioral advertising concerns.

[Catgic]

There Are More Search Sites Than Just Five

How about ixquick.com, mooter.com...and more.

The article is a good start, but the list needs more work.

[crazynexus]

He said why..

He said that he only targeted the top 5 search engines, and he did mention a few others. Seeing as how the top 5 probably account for about 80-90% of all searches, I think that's a fairly good amount of coverage.

[SearchWatch]

The best privacy search engine available today is Yauba.com

Their privacy policy is one of the best I have ever seen:

Yauba's Privacy Policy:

Yauba's Internet privacy policy comes with no fine print, no footnotes, no caveats, no ifs, no ands, and no buts.

The entirety of our privacy policy is as follows.

We do not keep any personally identifiable information.

Period.

------------------------------------

Our Commitment to Our Users:

We offer our users the highest privacy protection of any major search engine in the world. We are the only major search engine company that offers users the option of an anonymous browsing mode, which when used properly, allows users to both search and browse third party websites safely and anonymously, without passing on any private, personally identifiable information.

We actively support and endorse the work of leading Internet privacy advocacy organisations. We are the only Internet search focused company globally (and the first media company based in India) to be approved as an official signatory to the United Nations Global Compact, the leading non governmental initiative sponsored by the United Nations which promotes social responsibility standards for corporations around the world. We actively support and work with Stanford University's Center for Internet and Society on efforts to promote greater Internet privacy standards online. We also sponsor not for profit educational programmes for schools and parents on Internet safety and security.

We firmly believe we have an important moral obligation to safeguard the privacy and security of our users. As a result, we do not request any personal information from you; we do not use any cookies whatsoever; and we delete all of your personally identifiable information from our servers on a daily basis.

[minoal]

Interseting wording!

The terms "bureaucrats" is used to qualify the European Unions representatives trying to protect what is left of our private life against invasion from US companies.
Same issue about the US Government willing to impose a visa (electronic and most likely an other steal of private information) to European visitors. I strongly support the emerging initiative to immediately require a visa form our US friends if such a measure is taken. I do not question "free trade" and competition up to the point where it is used to control my privacy. Not because I have something to hide, but because it is probably the last piece of freedom I(we) have!

[grillin_man]

Best in privacy because of vaporware?

Ask is perceived to be the best protector of privacy...because of the "upcoming launch of AskEraser"? Notice all of Ask's answers are future-tense - the rest talked about what they are actually doing today.

Not several months (maybe) from now.

Why not go back and clarify what ASK is actually, really doing today for the people who use their website.

[wmorriss]

But What About Protecting Privacy?

While I thought the article provided interesting information on how search engines use data, I think that the rankings could have been improved by taking into account how protective the companies are of the data they do collect. For example, Google actually resisted subpoenas when the government came calling for information on user searches. Though that doesn't make Google a perfect company, I'd think it should give it a bump in the privacy rankings.

A more extended response to the article, along with links to relevant EFF press releases can be found at: http://ephemerallaw.blogspot.com/2007/08/search-engines-and-privacy.html

[marileev]

Posting Profiles w/out Permisson - ZoomInfo

While some SEs have the cojones to step up and NOT turn over a person's searches, there's another category of spyders aggregating your information in a so-called "directory" or pseudo business networking site.

About a week and a half ago I discovered that I was listed multiple times an a terrible directory called "ZoomInfo." Their spyders went so far as to take info from an old cached jazz cafe's website that I designed in college (it no longer exists). I wanted referrals to do work in college, so I put my univ. email address there -- durr I know better now.

ZoomInfo generated a name specific page for me and posted my college email address without my permission. Customer service told me "All of ZoomInfo's information comes from corporate websites, press releases, SEC filings, and other public websites."

Okay, the public website that I did have info posted on was permission I specifically gave one website NOT named ZoomInfo.

Has anyone else come across this?

[sangiest]

privacy & the web analytics companies

info gathered--and maintained nearly forever--by web analytics
companies (Omniture, Web Trends, Google analytics) can be
more invasive than search engine data. Omniture, for example,
gathers and hosts tracking info on most of the leading e-
commerce site, news sites, banking sites, travel sites, etc.
Beyond tracking your searches, they have your credit card info,
passwords, shopping preferances, and news interests stored--
and cross referenced--indefinitley on their servers. Web
analytics is a much larger threat to internet privacy than search
engines. My recommendation? give up a little convenience and
DISABLE COOKIES!

[wone111]

awsome article... Thanks!

wish ask.com had email...

[benjmn]

Data protection Spanish authority

Data, privacy and web search engines.



THE WEB SEARCH ENGINES HAS
RESPONSABILITIES. THE SPANISH AGENCY
OF DATA PROTECTION SET UP
INTERNATIONAL POSITIONS.



The Spanish Agency of Data Protection
(AGPD) has done a report and a public
communication in which keeps an coherent
attitude according to the topic and the National
and International repercussions.



The press note and the report can be found in
this website: (https//www.agpd.es/index.php)



Then, as publishers are responsible for the
content in accordance with the laws that
regulates Internet and data protection, so
searches are.



Among the conclusions of the report, it should
be mentioned the seventh one that says
literally: ?It?s necessary to limit the use and the
preservations of the personal data? and the
number eight says: ?searching services must
respect the rights that people have to cancel
the data that some links show the public in
websites?. It means, every single or juridical
person can be against that his data are
indexed-link and are showed everybody.?



The report marks there is not a uniform policy
about privacy in web search engine. It is not
enough to protect personal information and it
should be more responsible and respectful.
The report says that some clear informative
mechanisms should be developed in order to
let the users know which use will be done to
their data.



Before now, web search engines have been
defending their no responsibility National and
Internationally under the fact that they only
search and give back on line information,
being the publishers responsible for that.



The point of view of The Agencia Española de
Protección de Datos opens a debate between
the two rights, trying to get equilibrium:
freedom of expression and privacy rights, both
of them included in the Universal Human
Rights Conventions.



Without no doubts, this scheme is the same
as the ones that are in the other countries
and, it will bring national and international
consequences, that will affect the laws about
data protection, new technologies, internet,
honour, intimacy and image protection.
Moreover, there could be criminal
consequences as well as changes of way of
the web search engine work, its algorism, its
index/links systems, and its development
policy.





Benjamin Nicolau

Ebame, lawyers, abogados

www.ebame.com <http://www.ebame.com/>

Lawyers, abogados.