Recall that in early 2007, Google announced it would “anonymize” its user search logs after 18-24 months. Later that year, Google reluctantly decided to add an expiration date to its web cookie, while Ask.com (unsuccessfully) tried to gain market share by giving users almost complete control over whether any data is collected. Then, in 2008, under pressure from EU regulators, Google announced it would anonymize its search logs after 9 months. Later, Microsoft endorsed the EU’s  Article 29 Working Party’s position that search companies should anonymize data retention logs after 6 months, but only if the other major search engines follow suit. None did, but Yahoo did agree to anonymize its logs after 90 days.

Microsoft has now decided to take the lead in search privacy and agree to the European Union’s demand that data retention be cut to six months. Previously, Microsoft de-identified its search logs immediately, but didn’t purge the IP address until 18 months. Now, de-identification still takes place immediately, and the IP addresses are completely removed in 6 months. Here’s the chart included with Microsoft’s announcement:

Microsoft’s bold move puts significant pressure on Google. Currently Google merely “anonymizes” IP addresses on its server logs after nine months, arguing it must retain user logs to improve their services, fight spam and abuse, and comply with legal obligations. I, of course, have been critical of this reasoning on various occasions, and now Microsoft appears to be confirming that long-term data retention isn’t necessary to run a successful search engine.

Google, the ball is in your court.

(Hat tip to Jules Polonetsky at the Future of Privacy Forum)

Related posts: (automatically generated)

1. New “Cuil” Search Engines Decides User Logs Aren’t Necessary
2. Microsoft Plans to Sell Search Ads – Privacy Concerns?
3. Google To “Anonymize” Personal Data after 18-24 Months
4. Comparing Search Data Retention Policies of Major Search Engines
5. Google Shortens Data Retention to 9 Months

The first was a tweet promising an email (not yet received) as well as the assertion that “For the record, we still don’t keep logs or store personal info”. It is kind of them to tell me this via Twitter, but unless their official privacy policy states such, this utterance has little value or legal authority. Cuil’s original privacy statement stated this explicitly: “We do not keep logs of our users’ search activity”. That clear and incontrovertible statement is no longer present in the current policy.

The second communication was also a tweet, confirming what I already revealed in my original blog post: “Our advertising partner can see your IP and query, but if you opt-out then they cannot and you remain completely anonymous”. Yes, if you click the right places you can opt-out of Cuil’s new practice of sending all your search terms and your IP address to some unknown advertising partner.

The third communication was a comment left on my original post by Anna Patterson, Cuil’s President and Founder. She states: “I rewrote it making it less legalistic and shorter. I figured instead of re-stating everything three times in three different ways, I’d just state things once. We still don’t keep track of users.”

While I appreciate Patterson’s forthrightness, her explanation is quite unsatisfactory.

First, Cuil’s original privacy policy could hardly be criticized for being legalistic or particularly long. Clocking in at 518 words, is it largely absent of any legal or technical jargon typical of most privacy policies. Microsoft Word calculates its Flesch Reading Ease at 54.1. By comparison, Facebook’s current privacy policy has over 3,500 words, and a Flesch score of 37.4 (the lower the score, the more difficult the text). Cuil’s policy was clear and concise.

Besides the empirical comparisons, Cuil’s original policy was very plainly written, with the thrust of the policy in bold font: “when you search with Cuil, we do not collect any personally identifiable information, period. We have no idea who sends queries: not by name, not by IP address, and not by cookies“. There’s no legalese present here. But now, the privacy policy simply begins with this statement: “When you search with Cuil, we do not keep any personally identifiable information, period.”  Notice Cuil now claims they don’t “keep” any personally identifiable information (they do, now, collect it and share it with 3rd parties), and they don’t explicitly include IP addresses among the items they don’t collect. Simply “personally identifiable information”, and who knows what they mean by that.

I suppose this claim that Cuil doesn’t “keep any personally identifiable information” is meant to mean the same as the missing “We do not keep logs of our users’ search activity.” That latter statement — so clear and so concise — was apparently removed in the spirit of shortening the policy and purging it of any legalese? I just don’t get it.

Usually when a search engines starts a new kind of advertising initiative, they go out of their way to be more open, explicit, and explanatory when it comes to user privacy (see, for example, Google’s proactive steps when they launched behavioral targeting earlier this year). Instead, Cuil stripped down their privacy policy. Further, I can’t find any press release or announcement regarding their new advertising partner(s) or how the advertising system works. There was some chatter in the field about possible partners earlier this year, but nothing I can find from Cuil itself. Who is this advertising partner that is getting my search terms and IP address? What are they doing with it?

Not cool.

UPDATE: I received another tweet from Cuil: “You have good points, and we appreciate the feedback. We’ll be discussing the policy more internally to further clarify.”

I’m hoping they’ll enter into a broader dialogue that isn’t limited to 140 characters, and directly address the issues I’ve raised. I replied to them suggesting, at the least, to re-insert the “We do not keep logs of our users’ search activity” language into their privacy policy, if it does indeed still apply. I’ve also urged more transparency regarding who their advertising partner is and how it works. We’ll see….

Related posts: (automatically generated)

1. Cuil’s Famous Privacy Policy No Longer Protects Privacy
2. New “Cuil” Search Engines Decides User Logs Aren’t Necessary
3. Cuil not so Cool
4. Google Wants You to Search for their Privacy Policy (and they get to record that query!)
5. Searching for Google’s Privacy Policy

Anyway, one of Cuil’s touted competitive advantages was that it didn’t track user search queries. Its original privacy policy (dated July 27, 2008) went to great lengths to make users feel comfortable about the privacy of their search activities, opening with this impressive declaration:

Privacy is a hot topic these days, and we want you to feel totally comfortable using our service, so our privacy policy is very simple: when you search with Cuil, we do not collect any personally identifiable information, period. We have no idea who sends queries: not by name, not by IP address, and not by cookies (more on this later). Your search history is your business, not ours.

The policy included a section on “Logs”, noting simply that “We do not keep logs of our users’ search activity.” In the policy’s “Cookies” section, Cuil confirmed that “We do not record the information in your cookies on our servers” and that “we do not store any personal information about you on our servers.”

Upon their launch, Cuil declared that its “methods guarantee online privacy for searchers”.

Cool.

Except, that’s no longer the case.

After about a year of futility, Cuil updated their privacy policy on June 1, 2009, noting that “We may soon be adding advertisements to Cuil. As a result, our privacy policy will change.” Hmmmm….

About a month later, on July 13, 2009, Cuil completely gutted their privacy policy, and the privacy-protecting measures that were once located therein. Gone is the statement that “when you search with Cuil, we do not collect any personally identifiable information, period. We have no idea who sends queries: not by name, not by IP address, and not by cookies”. Gone is the section on “Logs” stating that they don’t keep any. Gone is the confirmation in the “Cookies” section that Cuil does “not store any personal information about you on our servers”.

Each of these privacy-preserving sentiments have been stripped from Cuil’s privacy policy. Instead, there now is a section on “Advertisements”, stating:

Advertisements are from a third-party and when you click on ads, we direct you to another website. To place ads in the first place, we transmit the IP address, browser type, and the query to the third party. If you want to opt out, please visit the preferences panel.

Whoa! Cuil transmits my search query and my IP address to the third party advertiser in order to place the ad? That’s a radical departure from its original “Your search history is your business” mantra.

Cuil also goes out of its way to make it difficult for users to opt out of this wholesale sharing of a users search activity. The preferences panel does have a handful of settings on it. But you have to look closely to see the link to “Advertising preferences” in a font much smaller than the rest of the page (screenshot). Only when you click that does Cuil decide to offer you the option to turn this off (screenshot).

On a related note, I can’t even find the ads within Cuil’s search results. There are no obvious “sponsored links” or separate advertising section within their interface. And searches for “Las Vegas” and “New York Hotel”, keywords that should certainly spark some advertising activity, are the same whether I have the advertising preferences turned on or off. I’ve emailed Cuil asking for clarification for how advertising is integrated into their results.

UPDATE (11/6): Overnight, Cuil sent me a tweet indicating that “we still don’t keep logs or store personal info”, and promising an email. I look forward to receiving any kind of clarification as to why their privacy policy has been stripped of its teeth.

Related posts: (automatically generated)

1. More on Cuil’s Non-Privacy Policy
2. New “Cuil” Search Engines Decides User Logs Aren’t Necessary
3. Cuil not so Cool
4. Google Wants You to Search for their Privacy Policy (and they get to record that query!)
5. Searching for Google’s Privacy Policy

All this said, I was quite excited at the launch of Google Dashboard:

Google describes Dashboard as a simple way to view “the data associated with your account”, and that it will provide users “greater transparency and control over their own data.” Elsewhere, Dashboard has been described as a “big concession to users’ privacy rights“, as the answer to the question: “What does Google know about me?”, and as a place providing users “more control over the personal information stored in Google’s databases“.

Unfortunately, Google Dashboard is none of these things.

What Google Dashboard provides is a single place to browse the list of most of the Google services you’ve signed up for, quick links to their individual settings pages (including privacy settings & policies), summary statistics of your usage of these services, and indications of what details I’ve shared with others.

While this is a very convenient new interface, and a helpful reminder of some of the services and settings that I might have long forgotten were activated on my account, Dashboard isn’t providing any new transparency or new control over the data Google knows about me. I still only see that information Google wants to make available to me through its interfaces. I still only get to control the limited data Google allows me to control.

Sure, from the Dashboard I can go and look at my Web search history, for example (and this screenshot confirms that my TrackMeNot Firefox Extension is successfully sending ghost queries to Google!), and from there I can remove stored searches from the service. But remember, this is only removing the searches from the Web History service, not from Google’s primary search query logs (as Google acknowledges here). There is no new level of control over the personal information stored in Google’s databases. Simply convenience.

(And, FWIW, Dashboard could be made even more convenient if Google simply had a link to “Dashboard” in the upper right corner after you log in, rather than having to click Settings -> Google Account Settings -> View data stored with this account)

The convenience Dashboard provides is helpful. Users should be regularly reminded of what services they sign up for, what information is being collected, and what their current privacy settings are. And hopefully Facebook will follow Google’s lead and provide similar convenience. But, unfortunately, Google Dashboard is no concession to users’ privacy rights. A helpful step, but we still have a long road ahead of us.

UPDATE: Others agree with my assessment of Dashboard. ReadWriteWeb notes that “Google’s Privacy Dashboard Doesn’t Tell Us Anything We Didn’t Know Before”, while Mashable recognizes that “Dashboard is nothing more than a selected list of privacy-related settings”. And Fred Stutzman correctly observes in the comments below that “By creating this interface, Google gets to functionally define the “sense” of information collection/retention. That is, their sense of the boundaries of collection will be informed by the interface. But…this interface minimizes the true extent of data retention.” Indeed.

Related posts: (automatically generated)

1. Google on Transparency
2. Demanding Transparency in GoogleNews
3. Transparency in GoogleNews
4. Digital Footprints: Online identity management and search in the age of transparency
5. Google’s Privacy Principles Fall Short

And the description from the website where you can view them all:

August 4, 2006, the personal search queries of 650,000 AOL (America Online) users accidentally ended up on the Internet, for all to see. These search queries were entered in AOL’s search engine over a three-month period. After three days AOL realized their blunder and removed the data from their site, but the sensitive private data had already leaked to several other sites.

I love Alaska tells the story of one of those AOL users. We get to know a religious middle-aged woman from Houston, Texas, who spends her days at home behind her TV and computer. Her unique style of phrasing combined with her putting her ideas, convictions and obsessions into AOL’s search engine,  turn her personal story into a disconcerting novel of sorts.

Over a period of three months, a portrait of a woman emerges who is diligently searching for likeminded souls. The list of her search queries read aloud by a voice-over reads like a revealing character study of a somewhat obese middle-aged lady in her menopause, who is looking for a way to rejuvenate her sex life. In the end, when she cheats on her husband with a man she met online, her life seems to crumble around her. She regrets her deceit, admits to her Internet addiction and dreams of a new life in Alaska.

Note, however, that the data release wasn’t “accidental.” AOL released the data to aid research in how people use search engines. Their mistake was insufficient anonymization of the data.

Related posts: (automatically generated)

1. Does the EU Data Retention Directive Apply to Search Query Data?
2. Comparing Search Data Retention Policies of Major Search Engines
3. Article 29 Working Party: Opinion on Data Protection Issues Related to Search Engines
4. Google’s Unsatisfying Explanation for Retaining User Search Data
5. Preventing Another Search Data Debacle

As part of the on-going battle among major search engines related to search data retention policies, Microsoft has published this chart attempting to summarize and compare the state of anonymization in the search industry (click to enlarge).

Few techncial details about how the companies enforce these policies have been made public, and as Joris van Hoboken reminds us, de-identification is not the the same as anonymization. There’s good work to be done to confirm, validate, and test the procedures claimed by each of the major search engines.

Related posts: (automatically generated)

1. Does the EU Data Retention Directive Apply to Search Query Data?
2. Article 29 Working Party: Opinion on Data Protection Issues Related to Search Engines
3. CNet: How Search Engines Rate on Privacy
4. Comparing Search Engine Privacy Policy Visibility
5. Search Engines Index 85% of Visible Web Content

In early 2007, Google announced it would “anonymize” its user search logs after 18-24 months. Later that year, Google reluctantly decided to add an expiration date to its web cookie, while Ask.com (unsuccessfully) tried to gain market share by giving users almost complete control over whether any data is collected. Earlier this year, under pressure from EU regulators, Google announced it would anonymize its search logs after 9 months. And just last week, Microsoft endorsed the EU’s  Article 29 Working Party’s position that search companies should anonymize data retention logs after 6 months, but only if the other major search engines follow suit.

Apparently Yahoo! was listening, and has called the bluff, putting both Microsoft and Google in the hotseat.

Today, Yahoo! announced it will anonymize user log data after 90 days (with limited exceptions for “fraud, security and legal obligations”).  More importantly, Yahoo!’s new data retention policy will apply not only to search log data but also page views, page clicks, ad views and ad clicks.

This is significant. The AP has more details:

Under Yahoo’s new policy, the company will strip out portions of users’ IP addresses, alter small tracking files known as ”cookies” and delete other potential personally identifiable information after 90 days in most cases. In cases involving fraud and data security, the company will anonymize the data after six months.

Sunnyvale, Calif.-based Yahoo also said it will expand the scope of data that it anonymizes to encompass not only search engine logs, but also page views, page clicks, ad views and ad clicks. That information is used to personalize online content and advertising.

Yahoo will begin implementing the new policy next month and says it will be effective across all the company’s services by mid-2010.

Anne Toth, vice president of policy and head of privacy for Yahoo, said the company is adopting the new policy to build trust with users and differentiate it from its competitors. Yahoo also hopes to take the issue of data retention ”off the table” by showing that Internet companies can regulate themselves, Toth said.

That last point outlines Yahoo!’s primary motivation: build trust, differentiate, take data retention off the table. Ask.com tried to do this, but never had a critical mass in the first place to really make make any waves.

Time will tell how the market will react to this policy change. Hopefully Google will follow suit, as they typically react to any potential threat to market share by simply taking that differentiation “off the table” as well. And if Microsoft ends up buying Yahoo’s search business, they’ll likely be pressured into keeping Yahoo’s new policy in place. So, by the end of the day, perhaps the 3 major search providers will all embrace this new 90-day model. We can only hope.

Related posts: (automatically generated)

1. Google To “Anonymize” Personal Data after 18-24 Months
2. Microsoft Makes $44.6 Billion Bid for Yahoo
3. Does the EU Data Retention Directive Apply to Search Query Data?
4. Srinija Srinivasan: Perception and Policy at Yahoo!
5. Yahoo’s Site Explorer

This is big news…more later….

Related posts: (automatically generated)

1. Google To “Anonymize” Personal Data after 18-24 Months
2. More of Peter Fleischer Misleading on Google Data Retention
3. Google, Privacy International, and Data Retention
4. Does the EU Data Retention Directive Apply to Search Query Data?
5. Ask.com To Allow Users to Control Data Retention

Cuil (pronounced like “cool”), which claims to have an index three times the size as Google and ten times as Microsoft, aims to provide a difference kind of search experience than its friends in Mountain View:

Rather than rely on superficial popularity metrics, Cuil searches for and ranks pages based on their content and relevance. When we find a page with your keywords, we stay on that page and analyze the rest of its content, its concepts, their inter-relationships and the page’s coherency.

Further, Cuil has taken a quite difference stance regarding user privacy than Google:

We believe that analyzing the Web rather than our users is a more useful approach, so we don’t collect data about you and your habits, lest we are tempted to peek. With Cuil, your search history is always private.

In short, Cuil doesn’t retain any server logs of user search activities. From its privacy policy:

Privacy is a hot topic these days, and we want you to feel totally comfortable using our service, so our privacy policy is very simple: when you search with Cuil, we do not collect any personally identifiable information, period. We have no idea who sends queries: not by name, not by IP address, and not by cookies (more on this later). Your search history is your business, not ours.

More precisely:

Logs
We do not keep logs of our users’ search activity.

Cookies
Cookies are small files on your computer that websites create to store user preferences, such as language settings. Each time you visit a Cuil page, your computer’s cookies automatically provide Cuil with your preferences. You can change or delete your cookies anytime via your Web browser options.

We do not record the information in your cookies on our servers; your browser sends your preferences to us with each search request. This way, we do not store any personal information about you on our servers.

(Other search engines, such as Ixquick, make similar claims. In fact, Ixquick recently was awarded the first European Privacy Seal for its privacy-protecting efforts.)

What I find most interesting about Cuil’s privacy policy is that it contradicts what Google has been stating regarding the necessity of retaining user logs: that they’re necessary to improve their services, fight spam and abuse, and comply with legal obligations. I, of course, have been critical of this reasoning on various occasions, but it will be interesting to see if the mainstream press will bite on this, now that Cuil is getting some attention

Related posts: (automatically generated)

1. Cuil’s Famous Privacy Policy No Longer Protects Privacy
2. More on Cuil’s Non-Privacy Policy
3. Microsoft to Delete IP Addresses From Bing Search Logs after 6 months
4. Comparing Search Data Retention Policies of Major Search Engines
5. CNet: How Search Engines Rate on Privacy

Google, for whatever reason, isn’t directly acknowledging that there was public pressure to take this simple step. The announcement on Google’s public policy blog frames it in a self-congratulatory manner, noting how it’s putting “users’ privacy first and foremost” and strengthening user trust, etc, etc. And their main blog relates some odd story by Marissa Mayer about the history of measuring the number of words on Google’s homepage, and makes it sound like they had to make some great sacrifice to add the word “privacy” without violating the feng shui of the homepage. The word privacy doesn’t even appear in the title, so most causal readers won’t even know that’s what is being announced.

I’m thrilled Google has found the wisdom to add these 7 letters and a bit of HTML code to link to its privacy policy. I just wish they could be a bit more forthright in why it is important and why they’ve suddenly decided to make the change.

Related posts: (automatically generated)

1. On Google’s New Homepage, Privacy Fades Away
2. Disrupting Google’s homepage with a 14-charater string
3. Google’s Homepage Hypocrisy
4. Google Shills for Droid on Homepage
5. Google Adds Location History to Latitude: Feature Request, or Strategic Rollout?