Microsoft Reduces Search Data Retention To Six MonthsMicrosoft Reduces Search Data Retention To Six Months
That's three months less than the search data retention period observed by Google, which adopted a nine-month period in September.
In response to the call by a European Union policy group for a common standard for the anonymization of search data, Microsoft on Monday proposed a six month search data retention period as an industry standard.
That's three months less than the search data retention period observed by Google, which adopted a nine-month period in September, half of what it was before that. Yahoo has a 13-month search data retention period.
In April, the Article 29 Working Party, as part of its effort to interpret the applicability of EU data protection laws to Internet search providers, issued an opinion that stated it saw no basis to keep search data more than six months. It also said that the cookie files deposited on users' computers for purposes of tracking and identification should only be kept as long as necessary.
When Google reduced its search data retention period to nine months in September, it did so while noting that "it was a difficult decision because the routine server log data we collect has always been a critical ingredient of innovation." The company has said that it uses search data to improve search quality, to improve security, to fight fraud, and to reduce spam.
Microsoft, which has far less to lose in search advertising revenue under a more stringent data retention regime, appears to be more willing to accede to the Article 29 Working Party's recommendations, at least at this point.
"We fully support the Article 29 Working Party for its desire to have common industry standards for search data anonymization," said Brendon Lynch, director of privacy strategy for Microsoft.
Microsoft is supporting the full anonymization of IP addresses after six months and the deletion of cookies and cross-session identifiers.
Google previously committed to partial IP address anonymization, a process that involves deleting one of the four octets (eight bits) in an IP address. Under Google scheme, for example, the IP address 192.0.0.100 would become 192.0.0.xxx.
Critics of Google's approach believe this doesn't truly anonymize an IP address, particularly if other information is available about the user.
"You're limiting things down to a group of computers potentially," said Lynch. "But it may be if you've got all the other parts of the IP address and a wide range of search queries, that you still may be able to link it back somehow."
Ari Schwartz, VP and chief operating officer of the Center for Democracy and Technology, said that Google's approach is better than keeping the IP address, but short of getting rid of it entirely.
Google has said it is working to refine its approach to IP address anonymization but it hasn't yet disclosed details.
Google's anonymization of IP addresses is undermined by its cookie policy, however. Some Google cookies expire at the end of a session, other last six months, two years, 10 years, 30 years, or even 1,000 years (the reader_offline cookie). Some of those cookies may, in certain situations, provide a way to reconstruct missing IP address information.
"The real point of differentiation between the two companies is that Microsoft is saying it will eliminate all cookies on the server end," said Geoff Turner, a senior analyst at Forrester Research.
Google wants its users to choose when to delete cookies. But they don't always do so, observed Schwartz. "People can delete cookies but that's not the default," he said. "Even in Google Chrome, they don’t make it that easy for people to delete cookies."
Turner believes that Microsoft's decision to accept the Article 29 Working Party recommendations will put pressure on other search companies to follow. Until Google does so, however, it should enjoy an even greater competitive advantage.
As Microsoft puts it, "The search engine that has access to the most search data will have a competitive advantage because search data is used to improve the relevance of the search results."
Microsoft characterizes its endorsement of the Article 29 Working Party recommendations as an effort to protect users' privacy. However, its action may have relatively little impact in terms of online privacy overall. ISPs have access to search data and every other form of data that subscribers send and receive. According to Schwartz, ISPs retain records about what users do online for a year.
About the Author
You May Also Like