Verbatim: Search firms surveyed on privacy

To find out what kind of information the four major search companies retain about their users, CNET News.com surveyed America Online, Google, Microsoft and Yahoo.

We asked the same seven questions of each company. Their answers are reproduced below, with the responses sorted by the companies' names in alphabetical order.

---

AOL spokesman Andrew Weinstein

Q: What information do you record about searches? Do you store IP addresses linked to search terms and types of searches (image vs. Web)?
Weinstein: Any time a search is done on the AOL service or AOL.com, the left rail on the results page offers a list of the most recent searches conducted by that user.

related story
FAQ: When Google is not your friend

Google's vast database of its users' searches is a gold mine for police and curious divorce attorneys.

Thus, every time a user conducts a search, they automatically see their recent searches on the results screen, or they can review a list of the searches they have conducted over recent weeks by clicking on the "view all saved searches" button underneath those results or on the "saved searches" icon at the top of the results page.

The user has the ability to delete any individual search they have conducted by clicking on the trash icon next to it, or to delete them all by clicking on the "clear all" link on the results page.

Similarly, both the results and "saved searches" pages offer users the ability to "turn off" this functionality with two clicks. If a user opts out, AOL will no longer save or use their search results data. (Users can turn that functionality back on, of course, if they would prefer to have access to that data and the customization AOL can provide with it).

Past search terms and user preferences are associated with the user via a cookie that is linked to the screen name (if authenticated) or the browser, if not.

Given a list of search terms, can you produce a list of people who searched for that term, identified by IP address and/or cookie value?
Weinstein: No. Our systems are not configured to track individuals or groups of users who may have searched for a specific term or terms, and we would not comply with such a request.

Have you ever been asked by an attorney in a civil suit to produce such a list of people? A prosecutor in a criminal case?
Weinstein: Although we do not discuss what subpoenas or legal requests we may have received, we could not provide such information if asked.

Given an IP address or cookie value, can you produce a list of the terms searched by the user of that IP address or cookie value?
Weinstein: Yes. But--as discussed above--those terms are also visible to the user with their search results, and the user has the ability to delete any/all of those terms, or to turn off that functionality altogether.

Have you ever been asked by an attorney in a civil suit to produce such a list of search terms? A prosecutor in a criminal case?
Weinstein: We do not comment on subpoenas or legal requests we may have received. However, if the government came to us for records relating to the search behaviors of an individual subscriber, the subpoena would be covered by federal law under the Electronic Communications Privacy Act.

Do you ever purge these data, or set an expiration date of, for instance, two years or five years?
Weinstein: As stated on our searches results page, we currently save personally identifiable search data for up to 30 days. As stated above, users can delete that data at any time if they wish.

Do you ever anticipate offering search engine users a way to delete that data?
Weinstein: We already do. :)

(Editor's note: In a follow-up conversation, AOL added that not only is the information deleted, but backups are not kept either.)

---

Google spokesman Steve Langdon

Q: What information do you record about searches? Do you store IP addresses linked to search terms and types of searches (image vs. Web)?
(Editor's note: Google pointed to its list of Frequently Asked Questions on Google.com, which says in detail what is collected and stored.)

Given a list of search terms, can you produce a list of people who searched for that term, identified by IP address and/or cookie value?
Langdon: Yes. We can associate search terms with IP addresses and cookies, but not with users' names unless they are registered with Google.

Have you ever been asked by an attorney in a civil suit to produce such a list of people? A prosecutor in a criminal case?
Langdon: We do not share information about that. (Editor's note: Google did acknowledge, however, that it has had legal requests for Gmail e-mail.)

Given an IP address or cookie value, can you produce a list of the terms searched by the user of that IP address or cookie value?
Langdon: Yes.

Have you ever been asked by an attorney in a civil suit to produce such a list of search terms? A prosecutor in a criminal case?
Langdon: We do not share information about that.

Do you ever purge these data, or set an expiration date of, for instance, two years or five years?
Langdon: We keep data for as long as it is useful. There are several uses, several of which are described in our privacy policy and FAQ. There isn't a specified period.

Do you ever anticipate offering search engine users a way to delete that data?
Langdon: We have no plans to announce such a product. However, users can use Google without a cookie.

[dingleberry420]

IP address

If they only saved the IP address for a short period for security/legal reasons, I would feel a lot better about this. As I'm sure everyone here knows, once someone has an IP address, a John/Jane Doe lawsuit can follow up to tie a name to that IP.

[markbowman]

Won't use Google ever again

Google is tracking search terms to IP addresses?

So I type "B*sh sucks" and now google keeps that on my permenant record? And of course ISPs keep permenant records on every IP address you have ever had. So Now all the government needs to do is put two and two together and its has its potential terrorist list ready to go. Knock..Knock.. who's there? With all that is hapening tell me I'm wrong and it can't/won't happen?

How about this then. Hyper-global-healthcare.com "somehow" gets ahold Google's records(they apparantly don't delete anything) and then they figure out who has been searching for information on "lung cancer" and "how to quit smoking". Guess who gets kicked off their insurance plan?

There is no legitimate reason for Google to keep a record of what IP address searched for what. From this day forward I'm done with them, giving up my gmail account, and going to forward this article to everyone I can think of.

[milette]

Actually, there's a lot more to it...

Your IP address is only a TINY part of the information Google (and everyone else) use to link your searches to you. Every browser presents a 'signature' the includes the IP Address, Browser Version, Operating System and Version plus a whole lot more. This, plus information your ISP has CAN link your searches to a specific computer. However, if you have Cookies enabled you make it even easier, because every request is linked to your unique identifier contained in the cookie. All anyone has to do is grab your cookie (which you present in clear, unencrypted form every time you visit Google or ANY of the Google sites -- and they can link everything to you. What's even worse though is when you REGISTER for ANY Google site -- then, you may provide everything from your real name to your credit card number. THEN, you're toast. OH YES, and don't forget about a little piece of spyware called the Google Toolbar -- if you use it in 'advanced' mode, not only are all the searches you conduct through Google tracked, but also any searches you conduct through the toolbar -- but what's even worse is that this little bit parasite reports EVERY URL YOU BROWSE back to Google -- for ANY site you browse. Link that, with your cookie, with your registered Gmail or other Google account, and you have the PERFECT piece of spyware kit. Actually, if you read between the lines in their assorted 'privacy policies' -- you'll see that they can use ANY data you volunteer them for any purpose they want and for as long as they want -- including reporting it to the US Government in the event you are ever accused of ANYTHING. Welcome to Orwell's nightmare...