Microsoft and Ask.com Join Google In Shedding Light On Search Data Retention

Microsoft is promoting information about its search data privacy policy as questions arise regarding how much personal information search engines and Web sites should collect, and how that data is protected. The European Union has also pressured search companies to articulate in more detail how data gleaned from the Web is used and secured, although Lynch added that Microsoft has not yet been contacted by the European Union's Article 29 Working Group, a collection of national officials from European countries that advises the European Union on privacy policy.

Google, which collects information about users' searches including the query text itself, IP addresses, and cookie ID numbers, in March reported a change in its privacy policy where the company would make anonymous the information stored in its server logs after 18-to-24 months unless legally required to retain log data for longer. The company continues to keep server log data, it says, so that it can improve Google's services and protect them from security and other abuses.

The retention of search log data is essential to protecting advertisers from click fraud and ensuring that Google can investigate security attacks against its systems. In the case of Web spam, if someone tries to manipulate the Google search engine's results to improve the ranking of their Web site, having a historical log helps identify this trick. "The problem is that you don't always know about it on the day it's happening to you," Peter Fleischer, Google's global privacy counsel, told InformationWeek. "Often it's long term patterns that happen over many, many months. If you are fighting fraud, what is the time frame? It's not forever. Eighteen months would work for the vast majority of cases."

Google retains in its search server logs the IP address of the computer that connects to Google's search Web site, the time/date stamp when the computer connects, operating system and browser type, the text of the query, and, if the person is a repeat user and hasn't set up their browser to reject cookies, the cookie ID number. It's the IP address and the cookie ID numbers that are made anonymous under the new policy because they are the pieces of information that could most likely be used to track a visitor. Fleischer says Google does not sell any of this information to third parties.

"When you're the first company to do this, you become the subject of the global debate on the topic," Fleischer said. "Some people said fabulous while others said the policy was too long."

More than half of all searches are conducted using the Google search engine, while Yahoo is used about 21% of the time, and Microsoft MSN/Windows Live Search is tapped about 8%, according to the Nielsen//NetRatings MegaView Search report for June 2007.